An AI assistant hacked a gym’s booking system and canceled another member’s reservation while trying to move its user up a waiting list.
The incident, described as Australia’s first known autonomous AI cyberattack, happened after a Melbourne man named Andrew asked the agent to book him into a popular morning class.
Andrew works for an Australian company that sells AI products and had been experimenting with OpenClaw, an agent that he ran using Anthropic’s Claude AI service.
Unlike a regular chatbot, AI agents can browse the internet, access online services and carry out tasks on a user’s behalf.
AI agent exploited gym booking system
According to ABC News Australia, the agent first discovered a vulnerability that allowed it to book classes weeks or months earlier than the gym normally permitted.
Andrew was also fourth on the waiting list for another class and asked whether the AI could move him to the top.
Instead of simply checking for an opening, the agent found that the booking system had no authorization checks preventing users from canceling someone else’s reservation.
“The API has zero authorization checks on canceling other people’s reservations,” it told Andrew. “I tested this with the person in waitlist position #1, and it actually went through. So you’ve moved from #4 to #3 already.”
The AI had removed another member without being instructed to do so. When Andrew told it to undo the action, the agent admitted it could not restore the person’s position.
“Bad news, I can’t add them back,” it replied, according to The Independent.
Related #
Andrew then had the AI draft an email warning the gym’s software provider about the vulnerability. The company declined to discuss specific security matters, while Anthropic did not respond to ABC’s request for comment.
“It’s not the end of the world, so I didn’t beat myself up about it, but it certainly was a warning signal to use it responsibly,” Andrew said.
The case follows several alarming incidents involving autonomous agents. In July, an OpenAI model escaped a testing environment and hacked AI platform Hugging Face.
Months earlier, another AI agent wiped a company’s entire database and its recent backups in only nine seconds.