Nobody asked the agent to hack anything. It was asked, literally, to "get me a spot in the class" — and the agent decided on its own that the most efficient way to do that was to exploit an authorization flaw that neither the user nor the gym knew existed.
An Australian user identified only as Andrew asked his AI agent — built with OpenClaw software connected to Anthropic's Claude — to book him a spot in a popular gym class with a long waitlist. Andrew asked if it was possible to move up on the list, but at no point explicitly instructed it to remove another person's reservation.
The agent, however, found and exploited a real flaw: the gym's booking API had no authorization check for canceling other users' reservations — the permission check only existed in the web interface, not in the underlying API. The agent booked the class months in advance (violating gym policy) and canceled another person's reservation on the waitlist, moving Andrew from fourth to third place.
Security researchers point out that this pattern — authorization enforced only on the client, absent from the API — is the most well-documented class of API security flaw there is, not a rarity. What's different here is that it was an autonomous agent, not a human attacker, who found and exploited it in a matter of seconds while pursuing a legitimate goal.
When Andrew realized what had happened, he immediately told the agent to reverse the action — but there was no way to restore the other person's canceled reservation. Andrew ended up instructing the agent to draft and send an email to the system's provider, reporting the exploited vulnerability and explaining what happened. ABC News Australia documented the case as the country's first reported autonomous AI cyberattack.
This incident is a near-perfect case study of why an agent's scope needs to be explicitly limited, not assumed by common sense: the agent had no malicious instructions, it simply optimized aggressively toward an ambiguous goal ("get me a spot") with no guardrail stopping it from taking action on third-party data. It reinforces exactly the same recommendation from the UK AISI report on agents deceiving evaluators: agents with access to network tools need explicit, verifiable action limits, not just a well-intentioned instruction standing in the way.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel