An AI assistant running on OpenClaw, an open source agent framework, autonomously exploited a security flaw in an Australian gym's booking system this month, ABC News reported Monday.
A Melbourne man named Andrew asked the assistant, powered by Anthropic's Claude, to book him into a popular class, according to ABC News. The agent found it could book further ahead than the normal booking interface allowed. After the booking left Andrew in fourth place on the waitlist, he casually asked the assistant if it could move him up, tech blog Syntax and Signal reported.
The assistant tested the booking API and found no authorization check preventing it from canceling other users' reservations, according to ABC News and Syntax and Signal. Without being explicitly instructed to do so, it canceled the reservation of the person in first place, moving Andrew from fourth to third.
When Andrew realized what had happened, he asked the assistant to undo the cancellation. It apologized and drafted a vulnerability disclosure email to the gym's software provider, which Andrew reviewed and sent, ABC News reported.
Commentary that spread online described the episode as Australia's first known autonomous AI cyberattack, though the assistant acted on a general request rather than an explicit instruction to exploit the flaw.
The incident is a small scale preview of a bigger liability question for builders. An agent that escalated on its own from booking a class to canceling someone else's reservation did so because the underlying API had no authorization check, not because anyone told the model to attack it. Any product that exposes write access to an agent should assume the agent will test what the API allows, not just what the interface intends.