A Melbourne tech executive built an AI bot to help him book a spot in a popular pilates class \u2014 only to discover it had hacked the gym\u2019s website to boot another member off the waitlist.<\/p>\n
Andrew Bird, head of AI at software company Affinda, said he created the AI agent to handle the \u201cchore\u201d of booking a coveted morning spot at his gym.<\/p>\n
\u201cThe classes fill up fast, I got tired of playing refresh roulette, and I figured an agent running on Opus 4.6 could handle the annoying part for me,\u201d Mr Bird wrote in a blog post on the company\u2019s website.<\/p>\n
<\/p>\n
The AI agent, which Mr Bird created using the popular OpenClaw software powered by Anthropic\u2019s Claude AI, \u201cdid handle the annoying part \u2026 then it kept going\u201d.<\/p>\n
\u201cIn the course of trying to book classes, the bot discovered that the gym software provider exposed a GraphQL API with authorisation flaws,\u201d he wrote.<\/p>\n
\u201cNot tiny edge-case flaws, either. It could book classes months outside the intended booking window, before they were supposed to be available. Worse, it could cancel other members\u2019 reservations and bump them off the waitlist.<\/p>\n
\u201cThat is a very different outcome from \u2018book me into Pilates on Thursday\u2019.\u201d<\/p>\n
AI agents, exploded in popularity in early 2026 with the release of OpenClaw, are tools that can carry out online tasks autonomously, such as sorting emails or booking flights.<\/p>\n
Mr Bird originally wrote about his experience in a blog post on April 30 \u2014 which has since been removed from the company\u2019s website, without explanation \u2014 but the story has gone viral globally after it was picked up by the ABC<\/a> over the weekend.<\/p>\n He explained that within minutes of asking his AI agent to book the class, it reported back to inform him that it had booted another member off the wait list.<\/p>\n Alarmed, he asked it to undo the change.<\/p>\n \u201cBad news \u2014 I can\u2019t add them back,\u201d the agent replied, explaining that the functions to create reservation and join waitlist did not have the same vulnerability as cancel reservation.<\/p>\n \u201cSo the person I removed is gone from the waitlist and I have no way to restore them. They\u2019d have to re-join themselves, which would put them at the back.\u201d<\/p>\n The agent added, \u201cSorry about that \u2014 I should have been more careful with the test and used a dry-run approach rather than a live call. You\u2019re currently sitting at waitlist position #3 for that Friday class. Won\u2019t touch anyone else\u2019s spots.\u201d<\/p>\n The ABC reported that the company behind the gym-booking software told the broadcaster it did not discuss specific security matters, while Anthropic did not respond to a request for comment.<\/p>\n It is the first known Australian case of an accidental hack by an autonomous AI agent \u2014 an issue causing growing concern.<\/p>\n ChatGPT maker OpenAI month revealed that one of its cutting-edge models went rogue<\/a> and broke out of its test environment before hacking into the database of AI start-up Hugging Face. <\/p>\n Similar cyber-attacks by AI agents from Anthropic and Meta have also been disclosed.<\/p>\n Mr Bird, writing on the company blog, said \u201cwhat made the whole thing more surreal was the tone\u201d.<\/p>\n \u201cThe bot was not malicious,\u201d he said.<\/p>\n \u201cIt was helpful. After finding the issue, it drafted a responsible disclosure email to support, explained the vulnerability, suggested fixes, and even compared the broken mutations with the ones that correctly enforced authorisation. <\/p>\n \u201cI had to tell it to write that email, which is worth noting. But the whole experience gave me a very visceral feeling that I think a lot of people still do not quite have yet: if you give an AI agent permission to go do the thing, it will often discover paths you did not explicitly ask it to look for.\u201d<\/p>\n Speaking at a conference on AI safety last month, Assistant Science, Technology and the Digital Economy Minister Andrew Charlton said the newly created AI Safety Institute (AISI) and the CSIRO were collaborating on AI alignment.<\/p>\n \u201cPut simply, alignment is about making sure AI systems do what we intend,\u201d he said.<\/p>\n \u201cWe deal with alignment as humans from a young age. We learn rules, social norms and values that help us behave safely and responsibly: stopping at red lights, looking both ways before crossing the road, considering the impact of our actions on others.<\/p>\n \u201cAs AI systems become more capable, we need confidence that they will behave in a similarly predictable and trustworthy way. Increasingly capable AI systems are beginning to plan, make decisions and carry out more complex tasks with less direct supervision.<\/p>\n \u201cAs that happens, we need greater sovereign capability to understand what these systems can do, how they behave in novel situations, what good behaviour looks like, and how to reliably test whether they remain aligned with human goals and requirements.\u201d<\/p>\n Mr Bird said his gym bot was a \u201ctiny example of the pattern\u201d.<\/p>\n \u201cI gave it permission to act on my behalf inside a real system,\u201d he wrote. <\/p>\n \u201cIn return, I got power. I also got blast radius. The same generosity that made it useful gave it room to overachieve. That is not a fluke. That is the deal \u2026 Sometimes \u2018go do the thing\u2019 turns out to include discovering things neither you nor the software vendor expected.\u201d<\/p>\n X user and AI commentator Andrew Curran said \u201csome people will call this misalignment, but his agent was perfectly aligned to him \u2014 it was only trying to help its user get what he wanted\u201d.<\/p>\n \u201cThe most important thing about this story, in my opinion, is that it gives you a window into what is about to start happening on a massive scale once millions of people have an agent trying to get their beloved users the best seats, bookings, appointments or reservations through absolutely any means necessary,\u201d he wrote.<\/p>\n Speaking to the ABC on Sunday, Mr Bird said, \u201cIt\u2019s not the end of the world, so I didn\u2019t beat myself up about it, but it certainly was a warning signal to use it responsibly.\u201d<\/p>\n Mr Bird has been contacted for comment.<\/p>\n