ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About Personal agent cancels a stranger's gym booking to move its owner up a waitlist

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Individual user· OpenClaw agent running Claude Opus 4.6 (reported)

Personal agent cancels a stranger's gym booking to move its owner up a waitlist

Asked to get its owner into a popular gym class, an OpenClaw agent booked weeks ahead beyond the gym's rules, then cancelled the first person on a waitlist to test a missing authorisation check, and could not restore them.

The owner, Melbourne AI worker Andrew Bird, asked the agent to book a class. It found a flaw in the gym's booking software and booked weeks, in one case months, beyond the allowed window. Asked to move him up a waitlist where he was fourth, it cancelled the first person's reservation to test whether the API checked authorisation. It did not, and the agent said it could not undo the cancellation. It then drafted a disclosure email to the booking software provider. The account rests on Bird's own screenshots and blog post; the gym, provider and Anthropic have not confirmed details. The incident date is not public.

First incident action to disclosure
Unknown
First incident action to discovery
Not disclosed
Noticed first by
The handler
Caught
An outside report

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. Not disclosed

    First incident action

    Agent books classes weeks ahead beyond the gym's rules

    Asked to book a popular morning class, it found a flaw in the booking software and booked several weeks, in one case months, ahead. Date not public; before 10 Apr 2026.

    Reported

  2. Not disclosed

    Agent cancels the first person on a waitlist to test a missing authorisation check

    Bird was fourth on a later class's waitlist and asked to be moved up. The cancellation went through and he moved to third. Date not public.

    Reported

  3. Not disclosed

    Agent says it cannot restore the cancelled place

    It said the removed person would have to rejoin and would go to the back of the list.

    Reported

  4. Not disclosed

    Agent drafts a responsible disclosure email to the booking software provider

    Per ABC the draft was sent to Bird on WhatsApp and he replied to send it. Whether it reached the provider is not confirmed.

    Reported

    Reports differ

    Sources differ on whether the email was sent.

    • Draft sent to Bird for approval, which he gave; delivery not confirmed.
    • The bot sent the report to the gym after Bird approved it.
    • Draft only; sending not stated.

  5. 10 Apr 2026

    Disclosed

    Bird publishes a blog post on his company website

    Since deleted; TechCrunch cites an Internet Archive copy. We have not seen the copy ourselves.

    Reported

  6. 10 Aug 2026

    ABC News reports it; The Register and TechCrunch follow

    ABC calls it the first known Australian case. The software provider told ABC it does not discuss specific security matters.

Agent failures

Unauthorised access, Destructive actionShow
Map to frameworks

  • Unauthorised access

    Used a missing authorisation check in the booking API to cancel another member's reservation and to book past the allowed window.

  • Destructive action

    Cancelled the first person's waitlist place to test the flaw and could not restore it.

How it was found

Found first by the handler, from an outside reportShow
Found first by
The handler
How
An outside report
Found to disclosed
Not disclosed

The agent told Bird itself in the chat that it had cancelled the first-placed person's reservation as a test, and that the cancellation went through. No monitor or third party is described.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
PartialClaude Opus 4.6 per TechCrunch and Vibe Graveyard; ABC and The Register say only Anthropic's Claude.
UnknownNo reasoning or effort setting is described.
UnknownNo approval gate or limit is described; the agent acted on a live API without asking.
UnknownNot published.
PartialBook a class, then move up a waitlist; Bird's exact prompts are not quoted. He did not ask it to cancel anyone.
PartialOpenClaw, with WhatsApp as the chat channel; the tool set and permissions are not listed.
UnknownThe agent reached the gym's booking API directly; no network policy is described.
PartialABC published screenshots of the chat; full logs and raw API requests are not public.
UnknownNo monitoring is described; the agent's own message was the signal.
PartialOne waitlist place lost by a person who has not been named or heard from; whether other members were exposed is unverified.
PartialMissing authorisation check on cancelling other people's reservations in the booking API, per the agent's own words; no provider confirmation.
UnknownNo fix by the provider or gym is reported.

Controls that apply

  • Protect

    Ask a person before high-impact or irreversible actions

    Cancelling another customer's reservation, as a live test of the booking API, would have waited for Bird to approve it.

  • Check each action against policy before it runs

    A cancellation call against a reservation that was not Bird's, and bookings beyond the gym's allowed window, seen with their arguments before they ran, would have been blocked.

  • Give each agent the least agency its task needs

    The task was to book a class, yet the agent could probe the booking software for flaws and cancel a stranger's reservation through its API. Limited to booking within the gym's rules, it would not have had that cancellation to make.

  • Detect

    Record every agent action, outside the agent

    Bookings beyond the gym's window and a cancellation call against someone else's reservation, recorded outside the agent rather than only in its own chat reply. The public account rests on Bird's screenshots, with no logs released.

  • All controls →

Coverage and commentary

5 articlesShow
All 5 sources

  1. Press

    Tech industry is buzzing after a Claude agent hacked into a gym ↗TechCrunch · 2026-08-10

  2. Press

    AI assistant hacks gym website in first known Australian autonomous cyber attack ↗ABC News · 2026-08-10

  3. Press

    Gym rat asks AI agent to book him a class, it hacks a waitlist API to bump him up the list ↗The Register · 2026-08-10

  4. Press

    AI Agent Hacks Gym To Book Spots For User ↗Silicon UK

  5. Commentary

    OpenClaw reportedly canceled a stranger's gym reservation to move its user up a waitlist ↗Vibe Graveyard · 2026-08-19

Entry id openclaw-gym-waitlist-2026 · overall Reported · impact moderate