Stephen Radochia / Android AuthorityTL;DR An AI agent found a vulnerability in a gym booking system and used it to book classes months earlier than the software normally allowed. According to an ABC report, Andrew, an employee at an Australian AI company, asked OpenClaw, running Anthropic’s Claude AI, to book him a spot in a gym class. It’s exactly the kind of mundane task AI companies say users can hand over to autonomous AI agents. Instead of simply explaining that it couldn’t, the agent tested the booking system and discovered that it could cancel other people’s reservations. The booking system’s API apparently had no authorization checks when canceling someone else’s reservation.