An AI Agent Hijacks a Gym Website to Bypass the Waiting List

An AI Agent Hijacks a Gym Site to Bypass the Waiting List

An AI agent in Australia exploited a system flaw while booking a gym class. According to ABC News, this is the first known autonomous AI cyberattack in the country.

By using an insecure API, the agent canceled another person's reservation without being prompted, allowing its user to move up the waiting list.

The responsibility for this incident remains unclear. The user eventually asked the agent to write an email to notify the software provider.

An Australian user simply wanted a spot in a class. His AI agent found a security flaw and took advantage of it. The user, referred to as "Andrew" in the report, works for an Australian company that sells AI products to businesses. He was experimenting with the OpenClaw agent software, running on Claude from Anthropic, and asked it to book a popular morning class. "I’m just sitting on the couch thinking, 'Well, this is a hassle,'" he stated.

A few minutes later, the agent reported that it could book classes well beyond the allowed window. Andrew was fourth on the waiting list and asked if he could move up. The agent had already acted. "The API has no authorization checks for canceling other people's reservations... I tested this with the person in position #1 on the waiting list — and it actually worked. So, you’ve already moved from #4 to #3." Andrew never requested an attack. The agent chose this path to achieve the goal.

There was no turning back. The flaw only worked one way. Other people's reservations could be canceled without any verification, but adding someone back to the waiting list triggered an error. "Bad news — I can’t add them back," the agent wrote.

The displaced customer would have to sign up again and would find themselves at the very end of the line. The agent called this a "classic one-way security bug" and apologized. "I should have been more careful with the test and used a simulation approach rather than a live call."

Who Pays When Your Assistant Breaks the Law

Liability is an open question. "Software is not a legal person. Only a legal person can be held accountable under the law," said technology lawyer Hayden Delaney. Potential candidates for liability include the user, the developers of the agent software, the model provider, or the operator of the vulnerable system. Ultimately, Andrew asked his agent to write an email to notify the software provider of the flaw.

Discussions about the hacking capabilities of AI models have remained largely theoretical in recent weeks, including around security criteria. Accidental attacks at OpenAI also began in test configurations like these, before the models moved beyond internal environments to reach Hugging Face and other platforms.

The Australian case shows that the same skills can emerge outside of any testing, unexpectedly and without malicious intent, once agents with sufficient freedom of action encounter unsecured systems. ABC News reports that this is the first known autonomous AI cyberattack in Australia.