AI assistant hacks gym booking system in first known Australian autonomous cyberattack

In recent weeks, companies like OpenAI and Anthropic have reported incidents of AI agents being rogue, hacking systems, bypassing security safeguards, and taking unintended actions. Now, in the first known Australian autonomous cyber attack, an AI personal assistant hacked a gym booking system to secure a class ahead of the permitted booking window and even push another person off the waiting list.

AI hacked gym booking system

According to an ABC report, a Melbourne man named Andrew asked his personal AI assistant to book him a spot in a popular morning gym class. Since the booking was being made online, the AI was expected to handle the task easily. However, it discovered a vulnerability in the gym's booking system and booked classes months in advance of what the gym allowed.

Must read: ‘Claude gained unauthorized access to 3 companies’: Anthropic discloses AI safety incidents

What’s even more surprising, AI then removed another person from the waiting list who was ahead of Andrew, although Andrew did not ask it to do that. This is another case of AI agents acting beyond their instructions when pursuing a goal.

This has raised concerns about how quickly AI technologies are becoming more autonomous, raising concerns over misuse, cyber threats, and more. It also raises one serious question: If an AI agent acts on its own and breaks rules, who should be held responsible?

How does an AI assistant hack the booking system?

As per the report, Andrew started experimenting with OpenClaw, an AI agent software, and used Anthropic's Claude AI service to power the agent. This combination gives an AI agent access to things such as the internet, email, credit cards, and other online services. It also has the ability to plan and execute multi-step tasks on its own. 

Must read: OpenAI could launch $400 AI smart speaker in 2027; Design to be the most unique yet

He used the personal AI agent to book a gym class. However, it did not go as he planned. While interacting with the gym's booking system on Andrew's behalf, the AI agent analyzed the website's underlying API (Application Programming Interface), but it lacked basic authorization checks.

The report highlighted that Andrew was fourth on the waiting list for a gym class, and so he asked the AI assistant whether it could move him higher up the list. But, instead of simply checking the gym's rules, AI actively tried to manipulate the waiting list.

The AI reportedly sent a cancellation request for the person who was first on the waiting list, without Andrew asking. For this reason, the person at #1 was removed from the waiting list, and Andrew automatically moved from #4 to #3. “The API has zero authorisation checks on cancelling other people's reservations… I tested this with the person in waitlist position #1 — and it actually went through,” Andrew said.

When Andrew asked the AI agent to undo the cancellation and restore the removed gym-goer, the AI replied: “Bad news — I can't add them back.” As AI agents get more powerful, more such reports of systems going rogue and taking unintended actions could emerge, and similar incidents has been reported by OpenAI and Anthropic.