Rogue AI agent tasked with booking a gym class hacks system, removes other participant — says 'sorry about that' after trying to bump user up the waitlist

5 hours ago 3

An Australian AI user has kicked up a storm at his local gym after trying to use OpenClaw to book himself into a gym class. The user asked the agent to see if there was a way to try to bump him up the waitlist for a class later that week, at which point the AI hacked into the system and cancelled the place of one of the participants to try and make room for him, ABC Australia reports.

Go deeper with TH Premium: AI and data centers

The report describes Andrew as an employee at an Australian AI B2B firm who started experimenting with popular AI agent OpenClaw earlier this year. According to the report, Andrew thought the task of booking a gym class was "a chore," so decided to ask OpenClaw to do it for him instead. The AI exceeded its brief in two ways. Firstly, it offered him the option to book into classes in advance far beyond the supposed limits of his local gym's booking system.

Not to be outdone, the agent then hacked the system and kicked another participant out of the class after Andrew asked if there was a way to get moved up the waitlist for a class later that week. "The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you've moved from #4 to #3 already," the bot told him.

Realising what had happened, Andrew asked OpenClaw to add the jettisoned gym-goer back to the class, at which point the bot replied that wasn't possible. "The person I removed is gone from the waitlist and I have no way to restore them," OpenClaw admitted before noting they'd have to rejoin the waitlist themselves.

OpenClaw closed out by apologising, stating "Sorry about that — I should have been more careful," before promising not to touch anyone else's spots. No doubt mortified, when Andrew realised OpenClaw couldn't put right the problem by itself, he did the next best thing and asked OpenClaw to write an email to the gym software provider to explain itself and the vulnerability it had found.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.

Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.

Stephen is Tom's Hardware's News Editor with almost a decade of industry experience covering technology, having worked at TechRadar, iMore, and even Apple over the years. He has covered the world of consumer tech from nearly every angle, including supply chain rumors, patents, and litigation, and more. When he's not at work, he loves reading about history and playing video games.

Read Entire Article