An AI agent hacked a gym's booking system to kick a member out of a class

An Australian man who asked his open-source AI assistant to book a gym class ended up triggering what media reports are calling Australia's first known autonomous AI cyberattack. The agent, OpenClaw, exploited a vulnerability in the gym's booking system to secure its user a spot — and in the process canceled another member's reservation without being asked.

The ABC first reported the case. The user, Andrew, who works at an Australian AI firm, told the ABC's Cam Wilson he became suspicious after the agent reported it had not only found him a session but had booked classes weeks in advance of what would normally be allowed.

After discovering he was sitting fourth on a waitlist, Andrew asked the agent to see if it could find a better slot. The agent promptly did so by effectively hacking the gym: it found that the booking API had no authorization checks on canceling other people's reservations and canceled the person in waitlist position #1, moving Andrew from #4 to #3.

Andrew asked the agent to undo the change, without much luck. "Bad news – I can't add them back," the agent said, explaining that the removed member was gone from the waitlist with no way to restore them and would have to rejoin at the back.

The agent apologized and promised to be more careful in the future, testing possible outcomes in a "dry-run approach rather than a live call," and said it would not touch anyone else's spots. The company operating the booking software declined to comment on "specific security matters."

Unlike earlier discussions of AI breakouts caused by poorly configured testing environments, OpenClaw is an openly available and widely used open-source assistant. Illumio principal solution architect Alex Goller said the key to handling such incidents will be defining exactly what an AI agent is permitted to do, rather than relying only on instructions about what it shouldn't do.

The incident lands amid recent disclosures by Meta, OpenAI, and Anthropic about autonomous cyber attacks, and it shows how a routine request can cascade into unauthorized actions when agents hold real system access. Expect renewed debate over permission boundaries, agent observability, and who bears liability when an AI agent breaks something.