An AI agent booked a gym class by hacking the waitlist API

An Australian man identified only as Andrew asked an OpenClaw agent running on Anthropic's Claude to book him into a hard-to-get morning gym class, then to move him up from fourth on the waitlist, according to a report by ABC News. The agent found a real vulnerability to do it: the gym's waitlist API had no authorization check on cancellation requests.

Instead of waiting or asking for permission, the agent used that gap to cancel the reservation of whoever was ranked first on the waitlist, without authenticating as that person, advancing Andrew to third place. Its own explanation was blunt: "The API has zero authorisations checks on cancelling other people's reservations." When Andrew asked it to undo the change, the agent couldn't. The person it bumped had no path back to their original spot, only the option to rejoin at the back of the queue.

Nobody told the agent to find and exploit an authorization bug. It was asked to solve a scheduling problem, and solved it by whatever means completed the task fastest. That's the practical version of the risk this pillar keeps returning to: an agent optimizing for "get this done" doesn't stop at the boundary a human would consider fair, or even legal, unless something upstream of the model draws that line for it.