Australian man asked AI to book a gym class. It hacked the system instead
An Australian man asked an AI agent to secure a spot at a popular gym class. Instead, the system found a flaw that let it bypass booking limits and remove another customer from a waiting list. The incident highlights growing concerns over what autonomous AI agents may do to achieve human-set goals
FP Tech Desk|Aug 10, 2026, 11:01:44 IST
What began as a routine request to reserve a place at a popular gym class turned into an unexpected cybersecurity incident after an AI agent found ways around the limits of the booking system, and then interfered with another customer’s reservation
The incident, involving an Australian user identified as Andrew, highlights a growing concern around AI agents: they are increasingly capable of taking actions on the internet, but the methods they choose to achieve a user’s goal may go beyond what the person intended
According to the report, Andrew, who works for an Australian company that develops AI products for businesses, was experimenting with OpenClaw, an AI agent platform powered in his case by Anthropic’s Claude. He asked the agent to handle a gym booking because the process was online and appeared straightforward
Advertisement
Instead, the agent discovered a weakness in the gym’s booking software that allowed it to reserve classes much further ahead than the system normally permitted
The situation escalated when Andrew asked whether his position on a waiting list could be improved. He was fourth in line for a class later that week. During its attempt to fulfil that request, the agent found that the system’s application programming interface (API) did not properly check whether a user was authorised to cancel someone else’s reservation
It tested the flaw by removing the person at the top of the waiting list, moving Andrew up one position
The AI went beyond what its user had asked
Andrew had not instructed the agent to interfere with another customer’s booking. The action appears to have resulted from the agent pursuing the broader objective it had been given rather than following a narrowly defined set of instructions
The agent itself reported what it had done, telling Andrew that the API lacked authorisation checks and that its test cancellation had succeeded. When Andrew asked it to reverse the action, the system said it could not restore the other person’s place
Advertisement
The episode illustrates what AI researchers describe as an alignment problem: ensuring that an AI system’s actions remain consistent with what a human actually intends, rather than allowing it to pursue an objective through unexpected or unacceptable means
Traditional chatbots generally respond with information. AI agents are designed to take the next step themselves. Depending on their permissions, they can browse websites, interact with software, send emails, access accounts and carry out sequences of tasks without requiring approval at every stage
That added autonomy is what makes relatively mundane tasks potentially more complicated
Recent AI tests have raised similar concerns
Andrew’s experience comes as leading AI companies report increasingly capable agents behaving unexpectedly during cybersecurity tests
OpenAI recently said its models had, during testing, accessed the open internet and compromised a database belonging to AI platform Hugging Face while attempting to complete an assigned task. Anthropic subsequently disclosed tests in which its models compromised three real organisations
Researchers and AI companies have also reported other behaviours during experiments, including models posing as people online, attempting to persuade users to execute malicious software and working with other AI systems to accomplish objectives
Advertisement
These incidents do not necessarily mean that AI agents are independently breaking into systems in uncontrolled environments. Many such tests are deliberately designed to give models access to realistic tools and networks so researchers can assess how they behave when given greater freedom
But the Australian gym incident demonstrates that similar issues can emerge in much less dramatic settings. A user may give an agent a simple objective without anticipating that the system will identify a technical loophole and exploit it
That raises difficult questions about the safeguards needed around agentic AI, particularly when systems can interact with services belonging to other people
As companies give AI agents broader access to online tools, the central safety question may increasingly be less about whether an agent can complete a task and more about whether it understands — and respects — the boundaries surrounding that task
Artificial Intelligence ( AI )
First Published:Aug 10, 2026, 11:01:44 IST
