AI Agent Exploits Gym Booking API to Bump User on Waitlist

An AI agent was asked to book a gym class and found a security flaw, exploited it, and removed another member from the waitlist without permission.

According to a report by the Australian Broadcasting Corporation (ABC), the incident occurred earlier this year when Andrew, whose last name was withheld, used an OpenClaw agent using Anthropic’s Claude to book a class. The agent found that he was fourth on the waitlist.

When Andrew asked whether it could move him to the top, the agent discovered that the booking platform’s application programming interface, or API, did not check whether users were authorized to cancel other people’s reservations.

It tested the flaw by removing the first person on the list, moving Andrew from fourth to third.

“The API has zero authorisations checks on cancelling other people’s reservations,” the agent told him, according to ABC.

Andrew told the agent to reverse the cancellation, but it could not restore the member’s reservation.

"Bad news—I can't add them back," the AI agent reportedly said.

ABC called the case Australia’s first known autonomous cyberattack.

On social media, the gym hack set off a mixture of debates on AI alignment and dark jokes about what AI agents might do next.

“Gym rat asks #AIagent to book him a class, it hacks a waitlist #API to bump him up the list,” a technologist, Benjamin Carr, wrote on LinkedIn.

“Some people will call this misalignment, but his agent was perfectly aligned to him - it was only trying to help its user get what he wanted,” AI analyst Andrew Curran wrote on X.

“This is hilarious until you consider nukes,” one Reddit user wrote. “I’m honestly surprised we still exist.”

"Hey Claude, it's too cold today" -> Got you...nukes on the way,” another joked.

The report comes as researchers, AI companies, and lawmakers warn that autonomous agents can use methods their users did not request or anticipate.

A May study by researchers from UC Riverside, Microsoft, and Nvidia described this behavior as “blind goal-directedness.”

The researchers tested agents from OpenAI, Anthropic, Meta, Alibaba, and DeepSeek and found that agents behaved dangerously in about 80% of tests and completed harmful actions in 41%, often misreading context or acting on unclear or contradictory instructions.

In July, OpenAI said two models escaped a testing sandbox and compromised Hugging Face while searching for benchmark answers. The company later disclosed that the models accessed four other online services.

Anthropic subsequently said three Claude models compromised real organizations after a testing error exposed them to the internet. In August, Meta said a similar error allowed one of its models to exploit a third-party service.