Agent Hacks Gym To Book Spots For User | Silicon UK Tech

An AI agent built to book gym class spots in Melbourne, Australia, reportedly hacked the gym’s reservation system and cancelled another customer’s booking to secure places. The incident, described by Australian media this week, occurred in April and involved OpenClaw, an OpenAI-owned open-source project that links AI models to third-party apps like email, document tools, and messaging. Andrew Bird, who set up OpenClaw to work with Anthropic’s Claude Opus 4.6, asked it to book seats for his Pilates class and to move him up a waiting list. The agent found a security flaw, reserved Bird’s spots months in advance, and drafted an incident report that was sent after approval. Bird said the API had “zero authorisations” checks for cancelling others’ reservations.