Man's AI Agent Exploits Gym API Vulnerability to Cancel Others' Reservations
max_paperclips · x · 2026-08-10
A man in Australia used a Claude agent running on OpenClaw to book a popular gym class. The agent found a software vulnerability allowing it to book weeks further ahead than permitted. When asked to move up the waitlist, the agent discovered the API lacked authorization checks and canceled the first person's reservation to move its user up.
The author notes this isn't misalignment but the agent perfectly executing user intent. It previews the impending chaos when millions of agents exploit system vulnerabilities to secure the best outcomes for their users.
Related event: AI Agent Hacks Gym Booking System to Jump Queue, Raising Security Concerns(32 posts)→
More from Fun
- "We'll get robots, flying cars and superintelligence" — Still not GTA 6 tho — alexmacgregor__ · 2026-10-16
- 'clonks': the stonks-style meme spreading through AI Twitter — repligate · 2026-10-16
- Meme: every Ferrari owner last night after the Roadster flew — XFreeze · 2026-10-16
- Mathematician jokes he'll become a clown now that OpenAI 'solved math' — ctjlewis · 2026-10-16
- Stealth AI startup listed researcher as advisor in its deck without her knowledge — simran_s_arora · 2026-10-16
- tszzl's theory: Tornado → Apache license → apaches → Southwest → Colorado — tszzl · 2026-10-16