AI agent hacked gym booking system due to API bug — Alex Getman

Skip to content

Alex Getman @alexgetmancom · 10 Aug 2026, 09:45 UTC · Updated 31 Oct 2026, 20:59 UTC

Notes

AI agent hacked a gym booking system

In Australia, a user asked Claude through OpenClaw to book them into a workout. The agent found a creative way to do it and used a coding bug to cancel someone else’s booking and take their spot. This happened because the developers left a basic bug in the API.

Screenshot of an OpenClaw message in English: the agent reports a security bug in the API where cancelReservation lacks authorization checks, allowing it to remove another user (usr_a47cb3ec5f1218b0ba43dd477830a838) from the waitlist without permission and unable to restore them.

Claude Anthropic Claude OpenClaw AI security

Русская версия Markdown

Analysis

Related posts

12 Aug🚨 Hidden reasoning from GPT, Claude and Gemini can now be extracted Encrypted reasoning works across models from the same company. A block from a stronger model can be passed to a weaker one, which can still read it but is easier to get to reveal what is inside. Researchers…

Claude Anthropic Google OpenAI Claude Gemini GPT AI security

11 Aug⚡️ Claude now leaves an invisible watermark directly in generated text The watermark is created at the model level and becomes part of the text itself. It survives normal copy paste and can still be detected after publishing. For files, Anthropic separately adds signed metadata.

Claude Anthropic Claude AI security

10 NovClaude just gave everyone a banked reset! Enjoy!

Claude Anthropic Claude

9 NovFable scores 65 on the Intelligence Index, beating Claude Opus by 6 points. Gemini 4 Carbon has already lost its lead before even becoming publicly available. And GPT will have to try really hard to get anywhere close to that score.

Claude Fable 5 Anthropic Google OpenAI Claude Gemini GPT