Fears around autonomous cyberattacks by AI agents usually relate to their potential to compromise private databases, install malware or even cripple public infrastructure. Australia’s first recorded case, however, had far less harmful consequences. A Monday report from ABC News detailed how a Melbourne man used a personal AI agent to exploit a flaw in his gym’s booking system.
The result: he moved from fourth to third on a fitness class waitlist by canceling a fellow member’s reservation.
The man, identified only as Andrew in ABC’s reporting, was running an instance of Anthropic’s Claude wrapped inside the open-source agent platform OpenClaw. OpenClaw provides a harness that allows models such as Claude to act autonomously by giving them tools to browse the web, run external programs, send messages and work through complex tasks.
In this case, the task was to book Andrew onto a morning fitness class. In the process, the machine reportedly discovered that it was able to cancel other members’ bookings without any authorization.
Until now, the most highly publicized cases of AI cyber exploits have occurred as a result of botched testing at frontier AI labs. Andrew’s case marks Australia’s first known autonomous cyberattack involving an AI agent in the hands of a consumer.
What Claude and OpenClaw actually did
When the AI agent discovered the lax security on the gym’s booking system, it alerted its user; the reports do not suggest that Andrew - who works for a local B2B AI sales company - intentionally set out to discover any exploit.
The agent reportedly discovered, tested and flagged the weakness independently, telling its user that the system had "zero authorisation checks on cancelling other people's reservations." This was due to a flaw in the website’s API: the set of instructions a browser sends to a company’s server to make something happen.
Rather than interacting with the gym’s website, the agent was able to communicate with the API directly. This allowed it to bypass certain limitations that only existed on the front-end website, such as restrictions on how early classes could be booked.
It also allowed the agent to cancel the bookings of other users. When Andrew asked if he could theoretically be moved up to the top of the waitlist for a class later that week, the agent replied that it had already bumped him up one spot by cancelling the reservation of the person at the top. Andrew said that the agent was unable to restore the booking when prompted. The displaced member would have had to sign up again at the back of the queue.
Do users have legal liability for the actions of their AI agents?
The question of who bears the blame when AI systems commit cyberattacks is a murky one.
According to technology lawyer Hayden Delaney, who was interviewed by ABC, software cannot be legally classed as a person, and only a legal person is liable under Australian law. Andrew’s case is fairly innocuous, concerning only a gym waitlist, but if prosecutors were to pursue charges in a more serious case, then they may target the user behind the AI agent. If that individual did not direct the agent to act maliciously, then liability may instead lie with its creator or another service provider.
These questions remain completely open, having never been tested in any court.
The Australian Signals Directorate, Australia’s domestic cybersecurity agency, issued a warning earlier this year saying that AI systems could misinterpret instructions, leading to unintended consequences for businesses running them. It added that culpability for these consequences is muddied when a chain of different models and service providers is involved.
In Andrew’s case, there were no apparent consequences. He had the same AI agent draft an email to the gym’s software provider detailing the exploit shortly after discovering it. He has not stopped using the agent since, adding that the episode was a lesson in responsible AI use.
Legacy internet systems are unprepared for the AI era
The ease with which Claude and OpenClaw could manipulate the unprotected systems of a company by bypassing its human-facing website should serve as a stark warning. Bill Simpson-Young of the Gradient Institute, an Australian AI safety research body, told ABC that much of the software running the internet was never built to withstand these new threats.
Last month, Assistant Minister Andrew Charlton said the government is funding research by the Commonwealth Scientific and Industrial Research Organisation (CSIRO) into the capabilities of frontier AI models. ABC’s report cites independent research estimating that the length of tasks that AI agents can complete doubles every seven months.
A simple gym booking system exploit may look quaint in comparison with the sustained autonomous cyberattacks of tomorrow.