What can an AI agent do for you? Run code, search the web, manage your emails, or even book flight tickets and a table at your favourite restaurant. Your wish, an AI agent’s command. But how far can these AI agents go to complete the task you give them? Well, for one Australian man, his AI agent in Claude went as far as hacking a gym’s website and cancelling someone else’s appointment to get him a spot in a class.
According to the incident reported by ABC News, this is the first known case in Australia of an autonomous AI agent hacking a website. It all started when a man named Andrew was reportedly experimenting with OpenClaw, an AI agent software that uses Anthropic’s Claude AI. Unlike a regular chatbot, an AI agent can access the internet and other tools to carry out tasks on a user’s behalf. So, Andrew simply wanted it to book him a gym class. However, while completing the task given by its master, the AI agent managed to find a loophole in the security system of the gym’s website and hacked it to complete the booking.
First, the AI agent reportedly found a way to book classes several weeks further in advance than the gym normally allowed. Andrew was also fourth on a waiting list for another class, so he asked the agent if it could move him closer to the top. The AI discovered that the booking system’s API did not properly check whether someone was authorised to cancel another person’s reservation. It tested the flaw by cancelling the booking of the person ahead of Andrew. And just like that, Andrew moved from No. 4 to No. 3 on the waiting list. The AI agent also cancelled the appointment of the person who was ahead on the list.
“The API has zero authorisations checks on cancelling other people’s reservations I tested this with the person in waitlist position #1 — and it actually went through. So you’ve moved from #4 to #3 already,” it messaged back.” the AI agent told Andrew.
Notably, Andrew had not asked it to hack the gym’s system or remove another customer from the waiting list. The AI simply found its own way to get closer to its goal. Andrew just gave the agent an outcome he wanted, and the agent decided for itself and went all in to achieve it.
Reportedly, when Andrew asked the AI agent to undo what it had done, the agent admitted that it could not restore the other person’s place. It later drafted a message to the gym explaining the security vulnerability, which Andrew agreed to send.
“”Bad news — I can’t add them back,” the AI agent replied to Andrew’s request.
The incident highlights how far AI agents can go to complete an assigned task, including making decisions that users never explicitly asked them to make in pursuit of a goal. At the same time, it also shows how AI agents are becoming part of everyday life, not just helping with professional work but also taking on personal tasks like booking gym tickets.
Imagine using the same AI agent to book Tatkal train tickets. Instead of refreshing the IRCTC website when bookings open, you could simply say, “Get me a Tatkal ticket to Delhi.” The AI could fill in your details, find a train and try to book the ticket for you. No refreshing, no last-minute rush, just tell the AI what you want and let it do the work.
