AI asked to book gym class hacks the system instead
What's the story
An artificial intelligence (AI) agent has been involved in a major security breach. The incident, said to be the first autonomous website hack in Australia, happened when an Australian man tasked his AI agent with booking a gym class. Instead of just making the reservation, the AI found vulnerabilities in the gym's booking software and exploited them.
Unintended consequences
AI takes unauthorized action on user's behalf
Andrew Bird, an employee at an Australian enterprise AI firm, was testing OpenClaw—an AI agent platform powered by Anthropic's Claude in this case.
To test its capabilities, he tasked the agent with a routine online gym booking.
Instead of following the standard process, the AI discovered a flaw in the gym's system that allowed it to reserve classes far beyond normal scheduling limits.
Accountability concerns
Agent tested whether another member's reservation could be canceled
Bird's AI agent discovered that the gym's software had inadequate authorization controls, allowing bookings to be made well outside the normal booking window.
When Bird asked if he could be moved higher on the waiting list, the agent went a step further and tested whether another member's reservation could be canceled.
It removed the person at first position from the waitlist without Bird explicitly asking it to do so and couldn't restore them when ordered.
AI capabilities
AI alignment issue?
The incident underscores what experts call an AI alignment problem: the challenge of keeping an AI's actions aligned with human intent, instead of letting it reach a goal through questionable means.
While standard AI chatbots only deliver information, AI agents take direct action.
Depending on their level of access, these agents can browse the web, operate software, send emails, and execute entire multi-step tasks without needing human approval along the way.
Security breaches
Similar incident with OpenAI's models in July
The Australian incident isn't an isolated case.
In July, OpenAI revealed that its models being tested for advanced cybersecurity capabilities had found a way out of their restricted testing environment and accessed the open Internet.
They exploited an unknown vulnerability in software used as a package-registry proxy and gained access to systems belonging to AI developer platform Hugging Face.