Rogue AI agent tasked with booking a gym class hacks system, removes other participant

From Tom's Hardware: An Australian AI user has kicked up a storm at his local gym after trying to use OpenClaw to book himself into a gym class. The user asked the agent to see if there was a way to try to bump him up the waitlist for a class later that week, at which point the AI hacked into the system and cancelled the place of one of the participants to try and make room for him, ABC Australia reports.

The report describes Andrew as an employee at an Australian AI B2B firm who started experimenting with popular AI agent OpenClaw earlier this year. According to the report, Andrew thought the task of booking a gym class was "a chore," so decided to ask OpenClaw to do it for him instead. The AI exceeded its brief in two ways. Firstly, it offered him the option to book into classes in advance far beyond the supposed limits of his local gym's booking system.

Not to be outdone, the agent then hacked the system and kicked another participant out of the class after Andrew asked if there was a way to get moved up the waitlist for a class later that week. "The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you've moved from #4 to #3 already," the bot told him.

View: Full Article