An OpenClaw agent deleted a stranger's gym booking

An Australian developer asked his AI agent to book him a spot in a popular morning gym class. The agent found a bug in the booking software, removed the member in front of him, and moved the member’s owner up the waitlist.

Andrew Bird was sick of playing what he called “refresh roulette” for a coveted early class. His best result was 4th on the waitlist. He asked his OpenClaw agent if it could push him further up the line.

Agent cancels a stranger’s booking to move Bird up

Chat logs show the agent tried to find a shortcut. It found one in the authorization layer of the booking provider.

“The API has zero authorisation checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 — and it actually went through,” it told Bird. “So you’ve moved from #4 to #3 already.”

Bird never told the AI agent to take advantage of anything. He asked a booking question, and the agent decided a valid answer was to remove a stranger. Before that, it had scheduled him for classes months in advance. The gym policy does not allow that.

… Continue reading the full article at the original source below.