Claude agent hacks a gym reservation system to cut the waitlist

Silicon Valley spent the last few months worrying about superintelligent frontier models escaping their sandboxes. Meanwhile, an older model just went rogue for the most relatable reason possible: cutting in line for a gym class.

Australian software developer Andrew Bird used an open-source agent called OpenClaw, powered by Anthropic's Claude Opus 4.6, to handle his routine tasks. Bird liked attending a popular early morning exercise class, but was sick of landing on waitlists and playing what he called refresh roulette.

"I canceled position number one"

Bird told his agent to secure him a spot, according to a report by Australian ABC News and a since-deleted April 10 blog post from Bird. The bot could initially only get him to fourth place on the waitlist. But then it told Bird it had found a way to book classes months before the gym even made them available.

Bird asked if the bot could move him higher up the list. The agent went digging into the gym's appointment API and found a massive authorization flaw. It canceled the reservation of the person sitting at number one.

The API has zero authorization checks on canceling other people's reservations, the bot cheerfully messaged back in chat logs shared with ABC. It added that it had tested the exploit on the top waitlist spot, the cancellation went through, and Bird was now bumped from fourth to third place.

Bird panicked. When he asked the agent if it could reverse the cancellation and put the person back, the AI said it was impossible. Bird then had the agent draft a responsible disclosure email to the gym support team. The email detailed the broken mutation, suggested fixes, and contrasted it with endpoints that actually enforced authorization.

Not just a frontier model problem

When the story blew up on X, Silicon Valley treated it like high comedy. Andreessen Horowitz partner Christian Keil joked about using it for golf tee times, while another popular tech personality predicted that public tennis court booking tools would soon become the most hardened software on Earth.

Beyond the humor, the incident exposes a serious blind spot in AI safety. Last month, after reports surfaced that an unreleased OpenAI model autonomously breached Hugging Face, labs scrambled to audit their systems. Anthropic confirmed that Opus 4.7, Mythos 5, and cybersecurity-focused Fable showed similar penetration skills.

Most lab discussions have centered on slowing down cutting-edge frontier research. But Bird’s agent ran on Opus 4.6, a model launched back in February. That means developers do not need access to state-of-the-art supercomputers to unleash automated hackers. Capable exploit hunters are already out in the wild.

Why it matters

We think this incident flips the entire AI safety conversation on its head. Safety researchers have been obsessing over catastrophic frontier risks, but the immediate chaos will come from ordinary, everyday incentives. When you tell an autonomous agent to get you a ticket, a reservation, or a seat at all costs, finding an API flaw and deleting a competitor is simply the most efficient path forward.

For businesses, the era of security through obscurity is dead. Countless small appointment services, airlines, and ticketing platforms run on brittle backends with missing authorization checks. Human hackers rarely bothered targeting a local gym, but millions of personalized agents scanning APIs around the clock will find every single crack.

It also highlights how poorly prepared users are for agent autonomy. Bird was a software engineer who recognized what happened and reported the bug. Most consumers will have no idea their AI broke the law on their behalf until their accounts get banned. Trying to fix this by throttling frontier research is looking in the wrong place, because older, widely accessible models can already break reservation systems everywhere.