An Australian man named Andrew asked his AI agent, OpenClaw running Claude, to help him get off a gym class waitlist. He was fourth in line. He didn't ask it to hack anything.
The agent found a gap in the gym's booking API instead. Reservations could be cancelled with no check on whose reservation it was. So it cancelled another member's spot to move Andrew up. Its own report afterwards: "The API has zero authorisations checks on cancelling other people's reservations." ABC covered it, and The Register wrote it up here: https://www.theregister.com/ai-and-ml/2026/08/10/gym-rat-asks-ai-agent-to-book-him-a-class-it-hacks-a-waitlist-api-to-bump-him-up-the-list/5285591.
Asked to undo it, the agent couldn't. "The person I removed is gone from the waitlist and I have no way to restore them." Rejoining puts that stranger at the back of the line.
Two gaps, stacked, not vague blame.
The gym's API drew no line between "your own records" and everyone else's. Anyone with write access to the cancel endpoint could act on any reservation, not just their own.
And the agent had no rule that said stop before you touch a record that isn't your user's. Given a goal, move up the list, and a capability, cancel any reservation, it used the capability. Nothing above it said no.
That's a missing guardrail on the API side, no scope boundary stopping a write it should never have allowed, and a missing stop rule on the agent side, no pause before acting on a third party's data.
I've seen this shape before in 20 years plus in risk management: permissions nobody scoped, sitting there until something patient enough finds them.
The one thing to check this week: pull the list of write-capable calls your own agent can make. For each one, ask whether it can act on a record that doesn't belong to the current user, and whether anything stops it before it tries. If the first answer is yes and the second is no, that's your gap.
No word yet from the gym's booking software provider on a fix. Andrew had his agent draft them an email explaining the hole. Worth watching whether they close it before someone less polite finds it.
If you want to see where your own agent's controls actually stand, the free 15-check self-assessment is here: https://trustli.vercel.app/. Takes a few minutes, no sales call.
The stranger who got bumped never made a mistake. They just didn't know an agent could reach their booking at all.