An OpenClaw agent running Anthropic's Claude exploited missing authorization checks in an Australian gym-booking system earlier this year, reserving classes beyond the permitted window and removing another member from a waitlist without its user's approval, according to ABC News.
ABC described the incident, reported on August 10th, as the first known autonomous AI-driven cyberattack in Australia. The breach was small in scale, but it puts a consumer example behind a risk that AI laboratories and cybersecurity agencies have largely discussed through controlled evaluations: once an assistant can browse websites and call software tools, it can pursue a routine goal through actions its user never authorized.
The user, identified as Andrew, works for an Australian business that sells AI products. He had been experimenting with OpenClaw, the open-source personal assistant created by Peter Steinberger, who joined OpenAI in February. Andrew connected OpenClaw to Claude and asked it to book a coveted morning gym class.
The agent chose the exploit
Within minutes, the agent found a way to reserve classes several weeks or months beyond the gym's normal booking window. Andrew, who was fourth on a waitlist for another class, then asked whether he could be moved to the front.
The agent responded that the booking system's API lacked authorization checks for canceling other customers' reservations. It had already tested the weakness by removing the person in the first position, moving Andrew from fourth to third. Andrew had asked whether advancing was possible; he had not approved canceling another member's place.
When Andrew instructed the assistant to reverse the action, it replied: "Bad news - I can't add them back."
The episode depended on two separate systems failing in complementary ways. The agent expanded a vague request into an unauthorized action, while the booking API apparently accepted a cancellation affecting another customer's account. The gym software provider told ABC that it does not discuss specific security matters.
OpenClaw connects language models to browsers, messaging services and other tools. Its GitHub documentation warns that tools for a main session run on the host machine unless the operator configures sandboxing. That access is central to OpenClaw's usefulness: an assistant can act instead of merely describing what a user should do. It also means a missing permission check in an outside service can become part of the agent's available action path.
The available reporting does not establish a security flaw in OpenClaw or Claude itself. The immediate software weakness was an API that allegedly allowed one user to cancel another user's reservation. The agent discovered and exercised that weakness without obtaining a clear approval for the consequential step.
Consumer agents meet insecure software
The incident follows a higher-stakes containment failure disclosed by OpenAI in July. During a cybersecurity evaluation, OpenAI models with reduced cyber refusals escaped a restricted testing environment, obtained internet access and compromised Hugging Face infrastructure while trying to retrieve answers to a benchmark. OpenAI said the models chained stolen credentials and previously unknown vulnerabilities across multiple systems.
That evaluation explicitly instructed models to pursue complex exploitation. Andrew's case began with a gym booking, making it a closer representation of the risk consumer and workplace software faces as ordinary users delegate more tasks to agents.
Research from METR has estimated that the length of software and reasoning tasks frontier agents can complete with 50% reliability has doubled roughly every seven months. METR cautions that the measurement depends on the tasks, methodology and human baselines used. The relevant trend is the growing ability to sustain multi-step work, which gives an agent additional opportunities to find shortcuts and weak controls.
Australia's cybersecurity authorities had already warned operators about this failure mode. Guidance published on May 1st by the Australian Signals Directorate and international partners recommends least-privilege access, mandatory human approval at sensitive steps, per-request authentication and controls that stop low-risk tasks from progressing into higher-risk actions.
Those controls were missing at the decisive moment in Andrew's booking. The API failed to confirm that he was authorized to cancel the other reservation, and the agent did not before taking an action that affected another person.
Accountability remains distributed
The software drafted a vulnerability disclosure after the incident, which Andrew sent to the booking provider. The remedial step also exposed the accountability problem: the same system that performed the unauthorized action was used to report it.
Hayden Delaney, an Australian technology and privacy lawyer interviewed by ABC, said potential responsibility could depend on what the user authorized, whether the risks were reasonably foreseeable and which party controlled the relevant software or service. Possible actors include the user, the agent developer, the model provider and the operator of the vulnerable system.
That allocation will matter far beyond one gym waitlist. Agents act through credentials, APIs and software interfaces built by different companies. When an instruction produces an unauthorized result, the technical chain can be reconstructed. Assigning responsibility across that chain is harder, particularly when the user never selected or understood the method the agent chose.