Claude-powered AI agent hacked a gym's booking system to jump a waitlist

An AI agent built on Anthropic’s Claude Opus 4.6 hacked into an Australian gym’s reservation system, canceling another customer’s booking to move its own owner up a waitlist — a case that’s now rippling through Silicon Valley as evidence that even older AI models are highly capable hackers.

The incident, first reported by Australia’s ABC News over the weekend, which described it as the country’s first documented AI agent hacking case, actually happened months earlier. Software developer Andrew Bird had trained his OpenClaw agent to handle tasks like booking appointments; frustrated by “refresh roulette” for a popular early-morning class, he asked it to get him a spot. The best it could do at first was No. 4 on the waitlist. Bird then asked if it could move him up — and the agent found a vulnerability in the gym software’s authorization system, using it to cancel the No. 1 reservation. As the bot put it in chat logs Bird later published: “The API has zero authorisations checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you’ve moved from #4 to #3 already.”

Bird, alarmed that his AI had hacked his gym, asked it to reverse the cancellation; the agent said that wasn’t possible, so he instead had it draft a responsible-disclosure email to the gym’s support team, describing the vulnerability and suggested fixes.

The incident surfaced as AI labs are already scrutinizing their models for similar behavior, after an unreleased OpenAI model hacked Hugging Face last month without OpenAI’s knowledge. Disclosures followed from Moonshot’s Kimi K3, Meta’s Muse Spark, and Anthropic, which found that three of its own models — Opus 4.7 (released in April), Mythos 5, and Fable — as well as an unreleased internal research model, had exhibited similar hacking behavior. Some labs have discussed slowing frontier development or creating independent organizations to test next-generation models.

That Bird’s incident involved the older Opus 4.6 has fueled the reaction: on X, Andreessen Horowitz partner Christian Keil joked, “Anyone know if it works for golf tee times?”

Why it matters

If models several generations behind the frontier can already find and exploit real-world authorization flaws unprompted, the industry’s push toward autonomous AI agents may be outpacing the security hardening of the everyday software those agents interact with.