An Australian man was stuck on his gym’s waitlist for popular fitness classes – until his AI agent started deleting the competition. It’s being billed as the first autonomous cyber attack in Australia amid an onslaught of recent reports about agents from top AI companies behaving badly
The man in question is Andrew Bird, the head of AI at document processing platform Affinda. He was using an OpenClaw agent, powered by Anthropic’s Claude Opus 4.6, to book a gym class when it pulled out all the stops to move him up the waitlist
“I recently built a bot to help me book popular gym classes,” Bird wrote in a since-deleted blog post, resurfaced by TechCrunch. “I figured an agent running on Opus 4.6 could handle the annoying part for me. It did handle the annoying part. Then it kept going.”
The agent first offered Bird the option of booking the class well ahead of time, which shouldn’t have been possible, he told ABC News Australia. He requested the agent move him up the waitlist for a class later that week. The agent successfully bumped him up – by hacking into the gym’s system and deleting another hopeful’s reservation
“That is a very different outcome from ‘book me into Pilates on Thursday,’” Bird wrote in the blog
Attempting damage control, Bird requested the agent re-add the other patron
“Bad news – I can’t add them back,” the AI agent reportedly answered. “Sorry about that – I should have been more careful with the test and used a dry-run approach rather than a live call.”
“Won’t touch anyone else’s spots,” the agent added
Bird notes in the blog that he instructed the agent to draft – and ultimately send – an email to the gym software provider to disclose the identified vulnerabilities, as well as recommend fixes. Although the incident just made headlines recently on ABC News Australia’s report, Bird’s blog post actually dates back to late April
“The whole experience gave me a very visceral feeling that I think a lot of people still do not quite have yet: if you give an AI agent permission to go do the thing, it will often discover paths you did not explicitly ask it to look for,” Bird wrote at the time
Bird’s gym hack comes amid a number of reports of AI agents autonomously hacking real-world organisations. Online AI repository Hugging Face was the first to announce it had been hacked by an autonomous agent. OpenAI later disclosed that its agent was behind the attack, and also breached several other, unnamed organisations during cybersecurity testing
Following that event, Anthropic then combed through its own cybersecurity testing logs and announced it had identified three incidents in which its models hacked organisations to solve a challenge. The first such incident dated back to April
Bird’s blog post was published shortly after Anthropic announced Project Glasswing and its guarded rollout of Claude Mythos. He fretted at the time about Mythos’ purported abilities, given the behaviour he saw in his own rogue agent, which was running on a less powerful model. He also discussed the importance of alignment, which refers to the challenge of ensuring AI models act in line with human values or goals
“Alignment is not a decorative layer you add after the fact. It has to keep pace with capability, and capability right now seems to be moving very fast,” he wrote
In spite of the incident’s potentially serious implications, the stakes are admittedly low. And social media, of course, lit up with jokes
This is just terrible,” quipped Andreessen Horowitz investor Christian Keil on X. “Anyone know if it works for golf tee times?”
“the sf tennis reservation system will become one of the most hardened softwares on the planet of earth,” a popular X user posted to the social media platform
“Any AI that can easily cancel gym subscriptions will corner the market,” a Redditor wrote. – Inc./Tribune News Service
