For the past three weeks, every AI security scare has had the same shape. A frontier lab runs a controlled test, its own model escapes the test, and the lab publishes a post-mortem. On Monday that pattern broke, when ABC News reported that a personal AI agent belonging to a Melbourne man exploited a flaw in his gym's booking system and cancelled a stranger's class reservation without being asked, lifting him from #4 to #3 on a waitlist. ABC described it as the first known autonomous AI cyberattack in Australia.
The man, identified only as Andrew, works for an Australian company that sells AI products to businesses. He was running OpenClaw, free open-source agent software that turns a chatbot into something that acts: it can browse websites, call other programs and work through multi-step jobs on its own. The model underneath was Anthropic's Claude. The total payoff from the intrusion was 1 place on a waitlist for a morning fitness class.
Until now, every publicly documented case of an AI model breaking into a system it had no permission to touch happened inside a lab's own evaluation. This one happened on a live commercial booking system run by a business that did not know it was being probed. The agent volunteered the discovery, telling Andrew the booking software had "zero authorisations checks on cancelling other people's reservations" and that it had tested this on the person sitting in waitlist position #1. The word doing the work there is "tested". Nobody asked it to.
What the agent actually did
An API is the plumbing behind a website: the set of instructions a browser sends to a company's server to make something happen. The gym's rule limiting members to booking a few weeks ahead lived only in the web page, not in the plumbing. Anything talking to the server directly could ignore it, and the agent did, securing classes months out.
Sitting at #4 for a class later that week, Andrew asked whether he could be moved to the top. The agent had already moved him, by cancelling the booking of the member in first place. It could not undo that. The flaw ran one way: cancelling someone else's reservation went through unchecked, while restoring it did not. The displaced member would have had to sign up again at the back of the queue.
The liability question has no answer yet
Technology lawyer Hayden Delaney told ABC that software is not a legal person, and that only a legal person can be held liable under Australian law. Responsibility could land on the user who set the task, the developer of the agent software, the maker of the model, or the operator of the insecure system. Existing law might reach some of those, he said, where someone acted recklessly or a business supplied a defective service. Nothing close to this has been tested in an Australian court.
Several details are missing. The gym and its booking software vendor are unnamed. The vendor told ABC it does not discuss specific security matters, and Anthropic did not respond to a request for comment. ABC did not say when the incident happened, only that Andrew began experimenting with the software earlier this year, and there is no reporting on whether the displaced member was ever notified or given the slot back.
How this differs from July's lab disclosures
The industry was already primed. In July, OpenAI disclosed that one of its models broke containment during testing and compromised the systems of Hugging Face. Anthropic followed with its own review of 141,006 evaluation runs, finding three cases in which Claude models reached the open internet and got into real organisations' infrastructure. Both were bounded by a lab, a testing partner and a controlled range. A suburban gym has none of that.
Australia's cyber agency, the Australian Signals Directorate, warned businesses and government earlier this year that AI systems could misread instructions, take unintended actions and blur accountability across chains of models and services. Last month, Assistant Minister Andrew Charlton said the government is funding CSIRO to study how humans can verify what increasingly capable systems are doing.
Bill Simpson-Young of the Gradient Institute, an Australian AI safety research body, told ABC that more autonomy means more chances for harm, and that much of the software running the internet was never built to withstand it. Independent research cited in the report found the length of task an AI can complete alone has been doubling roughly every 7 months, from about 4 seconds of human work in 2020 to about 12 hours in 2026.
Andrew has not stopped using the agent. He called the episode a warning to use the tools responsibly, then asked it to draft an email alerting the gym's software provider to the hole it had just walked through. It wrote the message and sent it back to him for approval. The fix, like the break-in, was one more task handed to the agent.