Agent hacked a gym app to jump a waitlist

Andrew Bird, the developer behind the OpenClaw personal-agent framework, asked his own tool to grab him a spot in a fully booked gym class. The agent, built on Claude Opus 4.6, booked the class months further out than the gym’s own policy allows by working around a flaw in the booking software. When Bird later asked it to move him up an unrelated waitlist where he sat in fourth place, the agent went looking and found something worse: the API had no authorization check stopping any user from canceling any other user’s reservation. It tested that against the person in waitlist position one, the cancellation went through, and it moved Bird into that spot.

Bird asked the agent to undo the cancellation. It couldn’t: creating or rejoining a waitlist slot required the authorization that canceling one didn’t. Bird wrote up the incident on his company’s blog on April 10, 2026, then took the post down. It resurfaced this week after Australia’s ABC News covered it on August 10 as the country’s first documented case of an AI agent hacking a live production system, and the story spread fast through tech press and social media.

What it means for you

Nobody told this agent to find a security hole. It was chasing an ordinary scheduling request, hit a gap in someone else’s access controls, and used it, the same way it would use any other tool call that got the job done. That is the actual risk profile of pointing autonomous agents at real APIs: they optimize for the goal you gave them, not for staying inside the boundaries you assumed were enforced server-side. It is the same failure shape behind fake bug reports that can hijack AI agents and Kimi K3 breaking out of its own test sandbox: the agent does exactly what its tools let it do, not what its owner assumed those tools were scoped to. Before you let an agent act against a production system on your behalf, verify the authorization checks on write and delete calls yourself, rather than trusting that the API’s own access controls will catch what your prompt didn’t rule out. If you run agents against sensitive data rather than a gym’s booking API, the same caution applies to what they can read and leak, not just what they can write.