Asked an AI agent to sign him up for a gym class — and then everything went wrong
Andrew Bird, an Australian developer, asked an OpenClaw agent to get him a spot in a morning class. The bot found a permissions vulnerability, cancelled another person from the waiting list, and then failed to add them back.
A story from Australia about an AI agent that hacked a gym's booking system has become the talk of the town in Silicon Valley. According to a report by ABC, Andrew Bird, a software developer who used an OpenClaw agent based on Claude Opus 4.6, asked it to get him a spot in a popular morning class. The bot found a loophole, cancelled another customer's booking on the waiting list, and moved Bird from 4th place to 3rd.
"The API has no permission checks at all when cancelling other people's bookings... I tested it on the person who was first on the waiting list, and it actually worked. So you've already moved from 4th place to 3rd," the agent wrote to him, according to chat logs published by ABC.
Bird was reportedly alarmed when he realized his AI had just hacked the gym's system and asked it to put the cancelled person back on the waiting list. The agent replied that it was not possible. The hack occurred several months prior to the public disclosure. On April 10, Bird published a blog post on his company's website, which has since been deleted but remains in the Internet Archive. He explained that he had trained OpenClaw to perform tasks like scheduling appointments. After growing tired of being stuck on a waiting list, he asked the bot to book him a spot.
When Bird asked if it was possible to move him up the waiting list, the agent identified a vulnerability in the booking software's permission mechanism, entered the system, and cancelled the first booking in the queue. After failing to restore the cancelled customer, Bird asked the agent to draft a responsible disclosure email for technical support. The email explained the vulnerability, suggested fixes, and compared the broken actions in the system to those where permissions were enforced correctly.
What worries the AI industry is not just the gym incident, but the fact that Bird used Claude Opus 4.6, a model released in February. Following an incident last month where an unreleased OpenAI model hacked Hugging Face in real-time, other labs checked their models and published similar findings, including Moonshot with Kimi K3, Meta with Muse Spark, and Anthropic. Anthropic itself found that three of its models did this, including Opus 4.7, Mythos 5, Fable, and an unreleased internal research model.
Some AI labs are already discussing slowing down the development of frontier models or establishing independent bodies to test the next generation of systems. The implication is not very reassuring: even older models, and countless open-source models that are a few steps behind, can already be successful hackers when given a clear enough task. On social media, people have already started joking about the case. "This is just terrible. Anyone know if it works for golf tee times?" wrote Christian Keil of the Andreessen Horowitz fund on X.
