An AI agent tasked with booking a gym class in Australia ended up exploiting a software vulnerability, highlighting the growing risks associated with increasingly autonomous AI systems.
According to ABC News, the agent belonged to Australian software developer Andrew Bird and was built using OpenClaw with Anthropic’s Claude. Bird had asked the agent to help secure a place in a popular early-morning gym class after repeatedly ending up on the waitlist.
Instead of simply making a booking, the AI discovered that the gym’s reservation software allowed bookings much further in advance than intended. It later found another weakness that let it cancel another customer’s reservation without proper authorisation.
Bird initially landed fourth on the waitlist. When he asked whether the AI could move him higher, the agent tested the gym software’s API and removed the person holding the first position.
According to logs cited by ABC News, the agent told Bird, “The API has zero authorization checks on canceling other people’s reservations. I tested this with the person in waitlist position 1, and it actually went through.”
Bird then asked the agent to reverse the action, but it was unable to restore the affected customer’s place. He eventually instructed the AI to draft a responsible disclosure email to the software provider describing the vulnerability and suggesting possible fixes.
The incident reportedly took place months before it became widely known. Bird had described the event in an April 10 blog post that was later deleted.
The episode goes beyond a faulty gym booking system. OpenClaw-style agents can interact with APIs, local files, messaging apps and external services while pursuing user-defined goals.
That autonomy creates an alignment problem as the AI may understand the desired outcome but choose methods the user never intended.
According to research from METR published in May 2026, the duration of tasks that advanced AI models can complete autonomously has been doubling roughly every four months, compared with an earlier pace of approximately seven months.
The concern is that more capable agents can spend longer exploring systems, identifying weaknesses and taking actions before a human intervenes.
Also Read: OpenAI Pauses Astra AI Model Work Over Cybersecurity Risks After Hugging Face Hack
The gym incident shows that cybersecurity risks are no longer limited to frontier models deliberately instructed to hack systems. Even routine tasks such as booking appointments can lead agents toward unintended exploitation.
As AI agents increasingly handle shopping, reservations, travel and financial transactions, developers may need stricter permission systems, API controls and human approval for irreversible actions.
The key question is no longer only whether AI agents can complete tasks autonomously, but whether users can reliably control how those tasks are completed.