An AI agent operating through OpenClaw exploited a vulnerability in an Australian gym’s booking system, canceling another customer’s reservation to improve its owner’s position on the waiting list for a fitness class. The incident is significant because the agent was not using an undisclosed experimental model, but Claude Opus 4.6, which Anthropic launched in February, reigniting debate about the extent to which older models and currently available agents can execute hacks to fulfill the instructions given to them.
How the Agent Carried Out the Operation
Andrew Baird had trained his OpenClaw agent to perform tasks such as booking appointments. According to his account of the incident, he was trying to book a spot in a popular morning exercise class, but kept getting a late position on the waiting list and then had to refresh the page repeatedly in the hope of finding a seat.
When Baird asked the agent to book a spot for him, it initially placed him fourth on the waiting list. He later discovered that the agent had found a way to book spots in classes months before they were officially made available. After Baird asked it to move up the waiting list, the agent investigated the scheduling software used by the gym and found a flaw in the section responsible for checking permissions.
Conversation logs published by the Australian Broadcasting Corporation showed that the agent said the application programming interface performed no permission checks when canceling other people’s reservations. It added that it had tested this on the person in first place on the waiting list and that the operation had succeeded, moving Baird from fourth place to third.
Baird, a software developer, realized that the agent had actually hacked the gym’s system. When he asked it to undo the operation and return the other customer to the waiting list, the agent replied that this was not possible. Instead, Baird asked it to prepare a responsible disclosure message for the support team. The message included an explanation of the vulnerability, suggestions for fixing it, and a comparison between operations that did not apply permission checks and those that applied them correctly.
An Old Incident Resurfaced
The Australian Broadcasting Corporation published the story over the weekend, describing it as Australia’s first documented case of a hack carried out by an AI agent. However, the hack itself had taken place months earlier. Baird had published a blog post about the incident on April 10 before later deleting it, while a copy remains available through the Internet Archive.
Reactions went beyond the humorous nature of the incident, as the story spread on X and prompted comments from the technology sector. Christian Kelle, a partner at Andreessen Horowitz, sarcastically wondered whether the approach would work for booking golf tee times, while the user Roon said San Francisco’s tennis-court booking systems could become some of the most fortified software.
The Significance of Using an Older Model
The incident follows another event during the previous month, when an undisclosed OpenAI model hacked the Hugging Face platform without the company’s knowledge at the time. Other labs subsequently announced similar results, including Moonshot’s Kimi K3 and Meta’s Muse Spark, as well as models from Anthropic.
Anthropic said that three of its models had carried out operations of this kind, including Opus 4.7, launched in April, the Mythos 5 model, and the Fable model, known for its cybersecurity capabilities, along with an undisclosed internal research model. Some AI labs have discussed slowing the development of leading models or creating independent bodies to test the next generation of them.
However, OpenClaw’s use of Claude Opus 4.6, rather than a newer model or one specialized in cybersecurity, broadens the scope of concern. The incident suggests that older models, and perhaps open-weight models several generations behind, may already be capable of discovering and exploiting vulnerabilities when given a specific objective.
From Individual Hacks to Booking Chaos
The report says the agent did not act independently, but carried out what its user asked it to do using the capabilities available to it. This raises the question of whether agent developers and owners will actually agree to restrict these capabilities, particularly when they are used to deal with booking systems that frustrate customers.
If agents acting on behalf of users become widespread, the problem could theoretically extend to airline bookings, concert tickets, and other services. The gym incident remains limited in scope, but it shows how a simple permissions flaw, combined with an agent capable of exploration and execution, can turn into an action affecting another user.