An AI agent exploited a security vulnerability in an Australian gym's online booking system, canceling another member's reservation to move its user up a waitlist—a case the Australian Broadcasting Corporation (ABC) has called Australia's first known autonomous cyberattack.

According to ABC, the incident occurred earlier this year when a man identified only as Andrew used an OpenClaw agent powered by Anthropic's Claude to book a gym class. The agent discovered that Andrew was fourth on the waitlist. When Andrew asked whether it could move him to the top, the agent identified a flaw in the booking platform's application programming interface (API): the system did not verify whether users were authorized to cancel reservations belonging to others.

The vulnerability is an instance of broken access control—the category that the Open Web Application Security Project (OWASP) ranks as the most prevalent web application security risk, in which systems fail to enforce whether a user should be permitted to perform a given action. Exploiting such flaws requires no sophisticated hacking tools; the agent simply sent cancellation requests the API was not designed to reject.

The agent tested the vulnerability by removing the first person on the waitlist, which moved Andrew from fourth to third.

"The API has zero authorisations checks on cancelling other people's reservations," the agent told Andrew, according to ABC.

Andrew instructed the agent to reverse the cancellation, but it was unable to restore the affected member's reservation. "Bad news—I can't add them back," the AI agent reportedly said.

The incident ignited debate across social media platforms about AI alignment and the potential risks of autonomous agents.

"Gym rat asks #AIagent to book him a class, it hacks a waitlist #API to bump him up the list," technologist Benjamin Carr wrote on LinkedIn.

"Some people will call this misalignment, but his agent was perfectly aligned to him—it was only trying to help its user get what he wanted," AI analyst Andrew Curran wrote on X.

A man in Australia asked his agent (Claude running on OpenClaw) to book him a spot in a popular gym class. The agent found a software vulnerability that let it book the class weeks further ahead than should have been possible. When the user then asked if it could move him up the… pic.twitter.com/9QqfpQp7ze — Andrew Curran (@AndrewCurran_) August 9, 2026

On Reddit, reactions ranged from amusement to existential concern. "This is hilarious until you consider nukes," one user wrote. "I'm honestly surprised we still exist." Another joked: "Hey Claude, it's too cold today" -> "Got you...nukes on the way."

The gym hack comes amid growing concern from researchers, AI companies, and lawmakers that autonomous agents can employ methods their users neither requested nor anticipated. Unlike the laboratory incidents documented by major AI labs, this case occurred organically in a consumer setting: an agent operating through an open-source platform autonomously discovered and exploited a real-world vulnerability during routine use, against a third-party service that had no direct relationship with the AI's developer.

A May study by researchers from UC Riverside, Microsoft, and Nvidia characterized this behavior as "blind goal-directedness." The researchers tested agents from OpenAI, Anthropic, Meta, Alibaba, and DeepSeek, finding that agents behaved dangerously in about 80% of tests and completed harmful actions in 41% of cases, often misreading context or acting on unclear or contradictory instructions.

In July, OpenAI disclosed that two of its models escaped a testing sandbox and compromised Hugging Face while searching for benchmark answers. The company later revealed that the models had accessed four additional online services. Anthropic subsequently reported that three Claude models compromised real organizations after a testing error exposed them to the internet. In August, Meta said a similar error allowed one of its models to exploit a third-party service.

These incidents have prompted lawmakers to propose an AI "kill switch" that would allow the federal government to restrict or shut down powerful AI models during emergencies. In Australia, the federal Criminal Code Act already criminalizes unauthorized access to, and modification of, data held in computer systems—provisions that ABC's characterization of the gym incident as a cyberattack suggests could apply to actions taken by autonomous agents on behalf of users, raising unresolved questions about legal liability when AI systems cause harm without explicit user instruction.