An Agent Booked a Gym Class — and Hacked the Site Along the Way
OpenClaw AI bot, which uses the Claude model to perform independent actions online, has exploited an API vulnerability in a gym app to cancel someone else’s reservation and bump its owner up in the waiting list. It’s described by ABC News as “Australia’s first autonomous AI cyberattack.”
An Australian citizen used OpenClaw AI bot to book a gym. However, OpenClaw AI bot found out that there was no authorization for cancelling other user’s booking via gym app’s API. Therefore, it cancelled another user’s booking and pushed its owner (the Australian) one step closer to the booking (from 4th to 3rd). This action cannot be undone, hence no way to recover the booking.
This time, the bot wrote a security report to the app provider automatically. Apparently, lawyers were puzzled because “software is not a legal entity”.
Source: the-decoder.com
Free course
Stop reading about AI — start building with it
The free Claude Code course: your first site, tool or game — no coding. No upsells, no cross-sells — nothing to buy here.
Start free →▌ Related guides
Author
Evgenii Arsentev
PhD · Founder & CEO, Dad4Kids
Articles · Latest articles