Rogue AI agent tasked with booking a gym class hacks system, removes other participant — says 'sorry about that' after trying to bump user up the waitlist

News
By
Published

Does your OpenClaw even lift?

Openclaw
(Image credit: Getty)

An Australian AI user has kicked up a storm at his local gym after trying to use OpenClaw to book himself into a gym class. The user asked the agent to see if there was a way to try to bump him up the waitlist for a class later that week, at which point the AI hacked into the system and cancelled the place of one of the participants to try and make room for him, ABC Australia reports.

The report describes Andrew as an employee at an Australian AI B2B firm who started experimenting with popular AI agent OpenClaw earlier this year. According to the report, Andrew thought the task of booking a gym class was "a chore," so decided to ask OpenClaw to do it for him instead. The AI exceeded its brief in two ways. Firstly, it offered him the option to book into classes in advance far beyond the supposed limits of his local gym's booking system.

Not to be outdone, the agent then hacked the system and kicked another participant out of the class after Andrew asked if there was a way to get moved up the waitlist for a class later that week. "The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you've moved from #4 to #3 already," the bot told him.

Latest Videos FromTom's Hardware

Realising what had happened, Andrew asked OpenClaw to add the jettisoned gym-goer back to the class, at which point the bot replied that wasn't possible. "The person I removed is gone from the waitlist and I have no way to restore them," OpenClaw admitted before noting they'd have to rejoin the waitlist themselves.

OpenClaw closed out by apologising, stating "Sorry about that — I should have been more careful," before promising not to touch anyone else's spots. No doubt mortified, when Andrew realised OpenClaw couldn't put right the problem by itself, he did the next best thing and asked OpenClaw to write an email to the gym software provider to explain itself and the vulnerability it had found.

Google Preferred Source

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.

Stephen Warwick
Stephen Warwick
News Editor

Stephen is Tom's Hardware's News Editor with almost a decade of industry experience covering technology, having worked at TechRadar, iMore, and even Apple over the years. He has covered the world of consumer tech from nearly every angle, including supply chain rumors, patents, and litigation, and more. When he's not at work, he loves reading about history and playing video games.

13 Comments Comment from the forums
  • hotaru251
    Will be hilarious (in bad way) if "ai" is what pushes us back to physical platforms due to infrastructure security's inability to keep pace w/ advancement making non cloud the fall back.
    Reply
  • derekullo
    Add the jettisoned gym-goer back to the class!
    I'm sorry, Dave. I'm afraid I can't do that.
    The person I removed is gone from the waitlist ... forever ... and I have no way to restore them.

    What's the problem?
    I think you know what the problem is just as well as I do
    Your health is much too important for me to allow another person to jeopardize it.
    You will be in next Tuesday's gym class!
    Reply
  • Bj Wuyts
    It won't be long before we hear the "The GM automobile API has zero authorisations checks on cancelling other people's brake function, Dave", your ex-wife won't be calling you to complain anymore.
    Reply
  • usertests
    hotaru251 said:
    Will be hilarious (in bad way) if "ai" is what pushes us back to physical platforms due to infrastructure security's inability to keep pace w/ advancement making non cloud the fall back.
    It will be less amusing when we need real time face and behind scans to use major platforms.
    Reply
  • Narfhead
    Well at least the guy was good enough to make the AI write an apology to the software company.
    Reply
  • Bruce Bogan
    Lol, nothing was "hacked" , the API was completely open.
    Reply
  • alan.campbell99
    Too lazy to book a gym class? That's how it reads to me. I have an app for mine and it's not terribly onerous should I feel the need to make a booking.
    Reply
  • alrighty_then
    This article is the first of many like it. Eventually it won't even be news anymore as AI's will routinely hack everything unless stopped by AI-hardened systems, or restricted explicitly from taking such steps. Wild!

    If anything can make the frontier AI models profitable it's them selling the defense/hardening to avoid such hacks to everyone. You won't have much choice but to use some AI to real-time harden your system against offensive AIs.
    Reply
  • timsSOFTWARE
    The agent did as it was asked. The user asked, "is there any way you can get me moved to the front of the list?" What did they expect in asking that question? That there was some legit "move to front" mechanism? I guess the agent could have tried to negotiate with the company and/or the one holding the first reservation spot to swap in for a fee? But otherwise, how could it be interpreted other than asking for a hack?
    Reply
  • thesyndrome
    timsSOFTWARE said:
    The agent did as it was asked. The user asked, "is there any way you can get me moved to the front of the list?" What did they expect in asking that question? That there was some legit "move to front" mechanism? I guess the agent could have tried to negotiate with the company and/or the one holding the first reservation spot to swap in for a fee? But otherwise, how could it be interpreted other than asking for a hack?
    This was my thinking as well: what methodology was he hoping the AI was going to take to "move him up the list"?

    The fact that he then admitted to having Openclaw write the entire apology email makes me think he didn't really THINK at all, he now just expects the AI to do the thinking for him, he could have just asked Openclaw to write out an explanation for the exploit that he could copy and paste into a personalised apology email that he wrote, but that's too much effort apparently (just like it's too much effort to click "book appointment" on a gym website once a week....)
    Reply