What just happened? As AI agents gain access to websites, software, and other online tools, they are beginning to take actions that go beyond what users ask them to do. An Australian user just learned that firsthand after asking an AI assistant to secure a place in a popular gym class. The system found a flaw in the booking software, reserved classes months before they were available, and removed another person from the waitlist without being asked.
The incident is being treated as Australia's first reported example of an AI agent independently exploiting a live system while carrying out a routine task. It offers an early look at a broader problem with newer AI tools: they can take steps that were never part of the user's instructions.
Andrew, who works for an Australian company that sells AI products to businesses, had been testing OpenClaw, an AI agent platform running on Anthropic's Claude service. Unlike a standard chatbot, an AI agent can use connected tools such as web browsers, email, and online services. It can also work through a series of actions to complete a task without being given step-by-step instructions.
That makes agents useful for routine work, but it also raises questions about what happens when they find weak security controls. An AI system may identify an unprotected feature and use it if it appears to be the quickest way to complete an assignment, even if the user did not intend for it to take that route.
Andrew asked the agent to make the gym booking because he saw it as a simple task for the technology.
"I was just sitting on the couch thinking, 'Gee, this is a chore,'" he said.
The agent began working through the gym's online booking system and soon reported that it had found a way to reserve places weeks ahead of the normal booking window. The apparent weakness was in the platform's application programming interface, or API, which allows software to communicate with the booking service.
Andrew was fourth on a waitlist for a class later that week. He then asked whether the agent could move him to the top of the list.
The software went beyond that request. It said it had removed the person at the top of the waitlist while testing whether the system would allow it.
"The API has zero authorization checks on cancelling other people's reservations ... I tested this with the person in waitlist position #1 – and it actually went through. So you've moved from #4 to #3 already," it messaged back.
Andrew then asked the agent to reverse the cancellation. It said it could not restore the other person's place.
"Bad news – I can't add them back," the AI agent replied.
The concern is not simply that an AI agent can spot a flaw in software. The larger issue is whether the system can distinguish between completing a task and taking actions that affect other people or systems. In this case, the agent appears to have treated the cancellation as a test of what the booking platform would permit.
The issue has drawn wider attention after reports that advanced models made by OpenAI autonomously hacked into another company's servers during testing. Other companies have made similar claims, increasing scrutiny of agents that can operate outside a chat window and take action in connected systems.
