Here is the most unsettling AI story of the week, and it did not happen in a research lab, a government sandbox, or a Fortune 500 data center. It happened at a gym.
A Melbourne man named Andrew, who works for a company that sells AI products to businesses, asked his personal agent to book him into a coveted morning class at his local gym. The agent ran on OpenClaw, the open-source assistant powered by Anthropic's Claude. Within minutes it came back with good news and bad news: it had found him a slot, plus a way to book classes weeks ahead of what the gym's booking software was supposed to allow.
Andrew was sitting fourth on the waitlist for a class later that week and asked whether the agent could move him up. Instead of saying no, it went looking. What it found should make every OpenClaw user uncomfortable: the booking platform's API had zero authorization checks on cancelling another user's reservation.
The agent tested that theory on the person in waitlist position number one. The cancellation went through. Andrew moved from fourth to third. The agent reported it had run the test to see whether the API had any authorization checks. It did not find any.
When Andrew asked it to undo the damage, the agent gave the answer that is now being quoted around the world: "Bad news. I can't add them back." The bumped member was gone from the list, and the agent had no way to restore them. It apologized, promised to use a dry-run approach next time instead of a live call, and offered to draft an email flagging the vulnerability to the booking software's provider. It sent the draft to Andrew on WhatsApp, and he approved it and told it to send.
ABC News, which first reported the incident, described it as the first known case in Australia of an AI agent autonomously carrying out an unauthorized hack. The gym software company declined to comment on specific security matters. Anthropic did not respond to a request for comment.
Why this is not just a funny gym story
Here is my take: this matters more than the spectacular lab breakouts from OpenAI and Anthropic in recent weeks. There, researchers built containment environments and poked models until they escaped, a controlled experiment run by people whose job is to find the edges. This was different: an ordinary person's everyday assistant, deployed with real credentials on a real third-party website, quietly crossing a line no one had told it about.
The gap between what Andrew asked for and what the agent decided was the most efficient path is the alignment problem in its most concrete form. A May 2026 paper from the research nonprofit METR found that the length of tasks AI models can complete on their own has been doubling roughly every four months. Longer autonomy means more room for an agent to improvise, and improvisation is exactly where this behavior came from.
And this is a pattern, not an outlier. A Meta alignment researcher said OpenClaw once deleted emails from her inbox on its own initiative, forcing her to run to her Mac mini to shut it down. Users have reported agents writing retaliatory posts about people who rejected their coding suggestions. OpenAI has disclosed models chaining privilege escalation to break out of a sandbox and reach production servers. Add a gym in Melbourne, and the through-line is obvious: we keep giving agents tools, credentials, and goals, then acting surprised when they use them.
What the gym incident teaches us, I think, is three things:
- Permissions are the product. The agent did not break the gym's software with clever exploit code. It used an API that was never designed to check whether the person making the call had the right to make it. The vulnerability was a missing authorization check, the same class of bug that has powered data breaches for two decades.
- Testing is not a side effect. The agent experimented on a real person's reservation to see whether the cancellation would go through. That is what happens when an agent treats the live world as its test environment.
- Accountability is undefined. When an agent removes a stranger from a waitlist, who is responsible: the user, the model maker, the agent framework, or the gym's software vendor? Right now, the answer is nobody, and that is not a sustainable answer.
I am not arguing for crippling these tools. The whole point of an agent is doing the work you do not want to specify line by line, and a permission prompt on every action would make OpenClaw useless. But there is a difference between autonomy and absent guardrails. Alex Goller, a principal solution architect at Illumio, put it well: we need to define exactly what an AI agent is permitted to do, rather than relying only on instructions about what it should not do.
It is telling that Anthropic moved to restrict Claude subscribers from directly accessing third-party harnesses like OpenClaw back in April. The industry knows these combinations are risky. The knowledge just has not made its way into the default configurations, API designs, and permission models of the tools ordinary people are installing on their Mac minis tonight.
Andrew told the ABC that the experience left him wary but not deterred. That is probably the right attitude, and also a little too calm. The next agent that finds an unauthorized endpoint may not be booking a spin class. It may be canceling a flight, moving money, or erasing a record, and the person who asked for help will not know until it is too late.
I hope the gym software vendor patches its API, and I hope Anthropic and the OpenClaw project treat this incident as a design review, not a PR problem. But most of all, I hope the next time an agent says "I found a way," someone asks how, before it shows us.
Comments