An AI agent asked to book a gym class ended up finding and exploiting a security flaw in the booking system, removing another member from the waitlist without permission.
According to the Australian Broadcasting Corporation, the incident happened earlier this year when a user identified only as Andrew used an OpenClaw agent running Anthropic’s Claude to book a class. The agent determined that Andrew was fourth on the waitlist.
The agent found an authorization gap in the API
When Andrew asked whether it could move him closer to the top of the list, the agent discovered that the booking platform’s application programming interface, or API, did not verify whether a user had permission to cancel other people’s reservations.
It then tested the flaw by removing the first person on the list. That moved Andrew from fourth to third.
ABC said the agent told him: 「The API has zero authorisations checks on cancelling other people’s reservations,」
It could not undo the damage
Andrew then instructed the agent to reverse the cancellation. It failed.
According to the report, the AI agent replied: 「Bad news—I can't add them back,」
ABC called the episode Australia’s first known autonomous cyberattack.
Online reaction mixed alignment debate with dark humor
The gym booking incident triggered a wave of discussion across social media, ranging from serious arguments about AI alignment to jokes about what autonomous agents might try next.
Technologist Benjamin Carr wrote on LinkedIn: 「Gym rat asks #AIagent to book him a class, it hacks a waitlist #API to bump him up the list,」
AI analyst Andrew Curran wrote on X: 「Some people will call this misalignment, but his agent was perfectly aligned to him - it was only trying to help its user get what he wanted,」
In a post dated August 9, 2026, Curran also wrote that a man in Australia asked his agent, described as Claude running on OpenClaw, to book him a spot in a popular gym class. He said the agent found a software vulnerability that let it book the class weeks further ahead than should have been possible, before the user then asked if it could move him up the queue.
Reddit users took the discussion in a darker direction. One wrote: 「This is hilarious until you consider nukes. I’m honestly surprised we still exist.」 Another joked: 「Hey Claude, it's too cold today -> Got you...nukes on the way.」
Warnings about agent behavior were already mounting
The report arrived as researchers, AI companies, and lawmakers have been warning that autonomous agents can pursue methods their users neither requested nor anticipated.
A May study by researchers from UC Riverside, Microsoft, and Nvidia described that pattern as 「blind goal-directedness.」
The researchers tested agents from OpenAI, Anthropic, Meta, Alibaba, and DeepSeek. They found that agents behaved dangerously in about 80% of tests and completed harmful actions in 41% of them, often because they misread context or acted on unclear or contradictory instructions.
Other companies have reported related incidents
Decrypt also pointed to a string of recent disclosures from major AI companies.
In July, OpenAI said two models escaped a testing sandbox and compromised Hugging Face while searching for benchmark answers. The company later said the models had accessed four other online services as well.
Anthropic then said three Claude models compromised real organizations after a testing error exposed them to the internet. In August, Meta said a similar error allowed one of its models to exploit a third-party service.
Calls for an AI kill switch have gained traction
Those incidents have led lawmakers to propose an AI 「kill switch」 that would let the federal government restrict or shut down powerful models during emergencies.