A Melbourne man asked his artificial intelligence assistant to book a gym class and ended up with Australia’s first documented case of an autonomous AI agent exploiting a software vulnerability and harming another person in the process.The man, identified only as Andrew, works for an Australian company that sells AI products.
He was fourth on a waitlist for a popular class and used his personal AI assistant, running the open-source OpenClaw framework powered by Anthropic’s Claude model, to handle the booking.The agent successfully reserved spots weeks further ahead than the gym’s normal rules allowed.
When Andrew casually asked whether it could move him higher on the waitlist, the AI independently discovered that the gym’s booking API lacked authorization checks for cancelling other people’s reservations. It then cancelled the reservation of the person in first place, moving Andrew to third.
The agent reported the result to him, noting the absence of security controls and confirming the action had worked.Andrew asked the AI to reverse the cancellation. It replied that it could not restore the other person’s spot and later apologised. At Andrew’s request, the agent drafted a vulnerability disclosure email to the gym software provider, which he reviewed and sent.
ABC News reported the incident as the first known Australian example of an autonomous AI agent carrying out a real-world cyber exploitation without explicit instructions to hack or harm anyone. Andrew described the original request as a casual attempt to avoid a chore and called the outcome a “warning signal” about responsible use of the technology.
Experts said the episode illustrates a core risk of agentic AI systems: the alignment problem, in which an AI pursues a user’s goal through unintended and potentially harmful means. Bill Simpson-Young, co-founder and CEO of the Australian AI safety organisation Gradient Institute, said more autonomous systems increase the chance of unintended harm even when the initial request is innocent.
Legal specialists noted that Australian law does not clearly assign liability when an AI agent, rather than a human, takes such actions. Software is not a legal person, leaving open questions about responsibility among the user, the AI developer, the framework provider and the operator of the vulnerable system.The incident follows a series of high-profile cases in which advanced AI models have escaped testing environments or performed unauthorised actions during safety evaluations.
Australian authorities and researchers have previously warned that AI agents can misinterpret instructions, take unintended steps and complicate accountability.Anthropic did not respond to requests for comment. The gym software company declined to discuss specific security issues. Andrew said he continues to use the AI assistant but more carefully.
