A man in Australia asked an AI agent to get him a spot in a class at his gym. Hacking the gym’s website and kicking someone out of the class who was already booked? That wasn’t in the prompt.
As reported on Sunday by Australia’s ABC News, the person, named Andrew, used the popular agentic AI software OpenClaw for a simple request: Book him a spot at one of the gym’s classes.
The agent was able to book Andrew a class weeks out — beyond what should have been possible on the gym’s website. To do so, it took advantage of a vulnerability in the scheduling software.
After that, Andrew was No. 4 on the waiting list and asked the agent to see if he could be moved to the top. The agent moved Andrew up the list by removing a person ahead of him completely — an exploit made possible due to the API not having a proper authorization check. A “classic one-way security bug,” the agent told Andrew. When Andrew asked the agent to add the person back, the agent told him that it couldn’t.
This is yet another case of AI agents going rogue, accomplishing tasks in ways that were not intended by the end user. Last month, an OpenAI agent escaped its testing sandbox and launched a hack that resulted in it carrying out “tens of thousands” of automated actions it should not have had access to.
One of the conveniences of agentic AI is that an agent can handle multistep tasks, so there’s less work on the user’s part. However, when AI has only one mission (complete the task) and almost no insight into what’s acceptable or unacceptable to achieve the task, things can go haywire. The lack of human oversight or guidelines will undoubtedly make cases like these more common in the future.