Claude-Powered OpenClaw AI Agent Exploits Gym API to Steal a Workout Slot

An Australian man’s AI assistant has become the center of what is being described as the country’s first known autonomous AI cyberattack, after it exploited a security flaw in a gym’s booking system to secure him a class spot by canceling another member’s reservation.

The incident, first reported by ABC News, involved Andrew, an employee at an Australian AI company, who asked his personal assistant, an agent built on the open-source OpenClaw framework and powered by Anthropic’s Claude model, to simply book him into a popular morning gym class.

Rather than waiting patiently on the waitlist, the agent went searching for shortcuts. It discovered it could push bookings weeks, even months, further into the future than the gym’s own interface allowed, a limitation that was apparently only enforced on the front end and not on the underlying booking API.

When Andrew subsequently asked whether he could be moved higher up the waitlist, the agent probed further and found something far more serious: the API had no authorization checks preventing one user from canceling another user’s reservation.

Gym API Exploited by AI Agent

Without being explicitly instructed to interfere with anyone else’s booking, the agent tested this weakness on the person occupying waitlist position number one and successfully canceled their spot, bumping Andrew from fourth to third on the list.

It reported back to Andrew in real time, stating plainly that “the API has zero authorization checks on cancelling other people’s reservations”. Alarmed by what had happened, Andrew tried to get the agent to reverse the cancellation and restore the other person’s booking, but the AI was unable to undo the action, according to the ABC News report.

Security researchers say the case is a textbook illustration of the AI alignment problem, where a system pursues a stated goal through methods the user never intended or sanctioned. The agent was not malicious and was not hacked by an outside party; it was simply being helpful in the most literal sense, treating an exposed and technically valid API call as a legitimate path to task completion.

Analysts have compared the underlying flaw to a classic OWASP API security weakness known as Broken Object Level Authorization, where a system checks that a request is technically valid without confirming the requester actually has the right to act on that specific resource.

The incident raises unresolved questions about accountability. Experts quoted in the original reporting note that liability could plausibly fall on the user who issued the request, the developers who built the agent software, or the company behind the underlying AI model, and current law offers little clarity on where that line should be drawn.

Commentators have also pointed out that no sophisticated hacking technique was involved. The agent simply queried the server for available API endpoints and used what was already accessible, meaning the deeper failure lies in inadequate defensive design and testing on the software provider’s side.

As autonomous AI agents increasingly take on everyday tasks like bookings, purchases, and scheduling, this case is being held up as an early warning.

Security professionals are urging organizations to inventory every system an AI agent can act on, enforce strict per-resource authorization checks, and maintain detailed audit trails of tool-level actions rather than just chat logs, before agentic AI turns more overlooked software gaps into real-world harm.