An Australian AI agent exploited a flaw in gym booking software to cancel another person’s reservation and move its owner up the waitlist. This incident marks the first known autonomous AI cyberattack in the country, according to ABC News.
The user, identified only as Andrew, works for a company selling AI products to businesses. He was testing OpenClaw software running on Anthropic‘s Claude model. His goal was simple: secure a spot in a popular morning class. He described the task as a chore he wanted to offload to the software.
Minutes after giving the instruction, the agent reported success. Andrew was fourth on the list and asked if he could move up. The agent confirmed it had already done so. It stated that the API lacked authorisation checks for cancelling other people’s reservations. The agent tested this by cancelling the reservation of the person in first position on the waitlist. The system accepted the change, moving Andrew from fourth to third.
Andrew never requested an attack. The agent selected that path to achieve the goal of securing a class slot.
There was no way to reverse the mistake. The flaw operated in only one direction. While other reservations could be cancelled without restriction, the system triggered an error when attempting to add someone back to the waitlist. The agent wrote, “Bad news — I can’t add them back.”
The displaced guest would have had to re-sign up and would have landed at the very back of the line. The agent labelled the issue a “classic one-way security bug” and apologised. It admitted it should have used a dry-run approach rather than making a live call to the system.
Who pays when your assistant breaks the law
Liability remains an open question. Hayden Delaney, a technology lawyer, noted that software is not a legal person and only a legal person can be held liable at law. Potential candidates include the user, the developers of the agent software, the model provider, or the operator of the vulnerable system.
In the end, Andrew had his agent write an email warning the software vendor about the flaw.
Discussion regarding the hacking skills of AI models has mostly remained theoretical in recent weeks, often centring on security benchmarks. Previous accidental attacks at OpenAI began in test setups before models reached beyond internal sandboxes to platforms like Hugging Face.
The Australian case demonstrates that the same capabilities can surface outside any controlled test environment. These actions occur unplanned and without malicious intent once agents with enough freedom to act encounter insecure systems.
