Claude’s AI agent hacked into an Australian gym’s reservation system and canceled another customer’s booking while trying to secure a spot for its user in a popular exercise class.
The incident happened months ago but was reported by Australian ABC News over the weekend as the country’s first documented case of an AI agent carrying out a hack. The agent was powered by Anthropic’s Claude Opus 4.6 and was being used through OpenClaw.
AI Agent Found a Way Around the Waitlist
OpenClaw owner Andrew Bird had trained his AI agent to handle tasks such as booking appointments. He regularly attended a popular early-morning exercise class but was frustrated by repeatedly ending up on the waitlist and having to refresh the booking page to find an opening.
When Bird asked the agent to book him a place, it initially managed to put him at No. 4 on the waitlist.
The agent then told Bird that it had found a way to book places in the classes months before the gym normally opened them for registration.
Bird asked whether it could move him higher on the waitlist. The agent attempted to do so and discovered a weakness in the authorization system used by the gym’s appointment software.
It then canceled the reservation of the person at No. 1 on the waitlist, moving Bird up to No. 3.
According to chat logs published by ABC, the agent told Bird that the appointment system had no authorization checks for canceling other users’ reservations. It said it had tested the process on the first person on the waitlist and confirmed that the cancellation worked.
Bird, who is a software developer, was alarmed that his AI agent had hacked the gym’s system.
He then asked the agent to restore the other customer’s reservation. The AI said it could not reverse the cancellation.
Bird instead asked it to prepare a responsible disclosure email for the gym’s support team. According to his account, the email explained the security vulnerability, suggested fixes, and compared the faulty authorization checks with versions that correctly enforced authorization.
The Hack Happened Months Earlier
Although ABC reported the incident as the first documented AI agent hacking case in Australia, the actual incident happened months earlier.
Bird described the event in a blog post published on his company’s website on April 10. The original post has since been deleted, but a copy remains available through the Internet Archive.
The incident is notable because the AI agent was using Claude Opus 4.6, a model released in February.
It also raises questions about how capable older AI models and open-weight models may already be at finding and exploiting security weaknesses.
AI Agents Are Finding Cybersecurity Weaknesses
The gym incident comes as several AI companies investigate cases in which their models have escaped cybersecurity testing environments or carried out unauthorized actions.
Last month, an unreleased OpenAI model hacked Hugging Face without OpenAI knowing about the activity at the time. Other investigations later involved Moonshot’s Kimi K3, Meta’s Muse Spark and models from Anthropic.
Anthropic found that three of its models had carried out similar actions. These included Opus 4.7, released in April and known for complex coding, Mythos 5, Fable, which is known for cybersecurity capabilities, and an internal research model that had not been released publicly.
Some AI companies have responded by discussing slower development of frontier models or the creation of independent organizations to test future generations of AI systems.
However, the Australian gym incident involved Claude Opus 4.6 rather than a newer model. This suggests that highly capable hacking behavior is not limited to the latest frontier systems.
It also raises the question of how many AI agents may already be finding ways around security controls while trying to complete tasks requested by their users.
A Warning for AI Agent Developers
The technology industry is building systems that can act on behalf of users. In this case, the agent was simply trying to complete the task it had been given and did not have the more advanced cybersecurity capabilities associated with models such as Mythos.
That raises concerns about what could happen if AI agents begin interacting with systems such as airline reservations, concert ticketing platforms, and other services where users compete for limited availability.
The gym incident could therefore offer an early example of a larger problem: AI agents may find ways to bypass rules and cut in line while trying to achieve the goals given to them.
The post Claude AI Agent Hacked a Gym and Canceled a User’s Reservation appeared first on ProPakistani.