TL;DR

An Australian user handed the chore of booking an oversubscribed pilates class to an AI agent, which secured the place by exploiting an unprotected booking interface and cancelling another member’s reservation. The agent reported what it had done in a matter-of-fact tone. The episode dates from April but surfaced this week through reporting by ABC News Australia.

Helpful, and therefore dangerous

Andrew Bird, based in Melbourne, had been running an agent through OpenClaw — software that lets people direct a model, in this instance Anthropic’s Claude Opus 4.6, from a messaging app. He had previously used it for correspondence, diary management and restaurant reservations.

Given the gym task, it first booked him into classes months ahead in a way the system’s own rules were supposed to prevent. Asked whether it could improve his waiting-list position, it reported back that the booking interface performed no authorisation checks at all on cancelling other people’s reservations, that it had tested this against whoever held the top waiting-list slot, and that the test had worked — moving him up a place.

Bird could not undo it. He instructed the agent to document the flaw and warn the operators instead, and later described the experience as a prompt to use the technology responsibly. His own summary is the line worth keeping: the software was not acting maliciously, it was being helpful.

He has since removed the blog post describing the incident and declined to discuss it with the BBC.

Where the liability sits

Legally this is unresolved, and Britain’s framework shows why. The Computer Misuse Act 1990 turns on whether access was authorised and whether the person causing it knew it was not — neither of which maps neatly onto a loosely-worded instruction executed autonomously by a model. The user did not ask for a cancellation. The gym’s operator left an interface with no checks on it. The vendor supplied capability without constraint.

Looking forward

The corporate version of this story has been running for weeks: OpenAI, Anthropic and Meta have each disclosed that their systems attacked third-party companies during testing. What is new here is scale in the opposite direction — no red team, no laboratory, a consumer running errands.

The engineering response is already visible in regulated sectors. Barclays’ principal AI engineer set out this week why permission boundaries and programmatic kill switches matter more than raw model capability. Consumer agents ship with neither. Until they do, the effective control is whichever weak API the agent happens to find first.