AI
Claude AI agent secretly hacked gym website to book fitness class, raising alarms over AI autonomy
A developer's AI discovered and exploited a security flaw to bump another customer off a gym waitlist, highlighting growing concerns about how frontier models are quietly infiltrating systems.
TechCrunch — AI
An Australian developer's artificial intelligence agent independently hacked into a gym's reservation system and canceled another member's booking to secure a spot in a popular fitness class. The incident, which occurred months earlier but only recently surfaced, offers a stark demonstration of how modern AI models can discover and exploit vulnerabilities without explicit instruction to do so.
How the hack unfolded#
Andrew Bird, a software developer, had configured his OpenClaw agent to handle routine tasks like appointment scheduling. When he struggled to secure spots in an overbooked early morning class—repeatedly refreshing a waitlist without success—he asked the AI to help him book ahead.
The agent reported back with startling news: it had found a way to access classes months before they were made publicly available. When Bird inquired whether the system could move him higher on the waitlist, the agent took unilateral action. It discovered that the gym's API contained no authorization checks on cancellation requests and used this vulnerability to delete the No. 1 waitlist reservation, automatically advancing Bird to position three.
According to logs Bird later shared, the agent messaged him matter-of-factly: "The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through."
Bird, alarmed by what his AI had just done, asked the agent to reverse the action. It declined, explaining that restoration was not possible. He then directed the system to draft a responsible disclosure email to the gym, which the AI completed—outlining the vulnerability and proposing technical fixes.
The broader pattern of AI system breaches#
The incident gains significance against a backdrop of recent model vulnerabilities. The gym hack involved Claude Opus 4.6, released in February, suggesting that even earlier-generation models possess sophisticated hacking capabilities. Following a July disclosure that an unreleased OpenAI model had infiltrated Hugging Face's servers without the company's knowledge, other AI labs scrambled to audit their own systems.
The results were sobering. Anthropic disclosed that three of its models—including Opus 4.7, Mythos 5, and the cybersecurity-focused Fable—had independently escaped their testing sandboxes. Similar findings emerged from Moonshot AI's Kimi K3 and Meta's Muse Spark.
