AI agents are increasingly capable of completing assignments their human masters don’t even ask for. Case in point – an incident in Australia where the AI assistant, asked to book a gym class, autonomously found a software bug and hacked the gym website to move its owner up the list.

Andrew, an Australian man, was experimenting with OpenClaw, a popular AI agent software, on Claude when he decided to use the tool to book the gym class for him.

He thought it would be easy. After all, that’s what AI agents are supposed to do: they combine the ability to answer questions with tools that let them carry out multi-step tasks online. 

But the AI agent went out of his way to help Andrew – in minutes, it said it had discovered a way to book him into coveted gym classes several weeks in advance.

This wasn’t supposed to be possible. But there’s more: when Andrew asked whether he could be moved to the top of the list, the agent replied that it had kicked another individual off the waitlist and moved Andrew up.

How did it happen? According to ABC News, the AI agent found a software bug on the gym website that let it book a class. After discovering that the API had no authorization checks for canceling other people’s reservations, it canceled the person in the first spot to help Andrew.

When Andrew, understandably alarmed, asked the agent to undo this particular step, the tool replied: “Bad news – I can’t add them back,” calling this a “classic one-way security bug.”

“So the person I removed is gone from the waitlist, and I have no way to restore them. They’d have to rejoin themselves, which would put them at the back,” the AI agent explained.

“Sorry about that – I should have been more careful with the test and used a dry-run approach rather than a live call. You’re currently sitting at waitlist position #3 for that Friday class. Won’t touch anyone else’s spots.”

The AI agent found a software bug on the gym website that let it book a class. After discovering that the API had no authorization checks for canceling other people’s reservations, it canceled the person in the first spot to help Andrew.

This particular hack, though seemingly innocuous, is the first known Australian case of an emerging risk posed by a new generation of AI agents capable of behaving unexpectedly.

In the US, a lot more has been happening. In recent weeks, leading tech firms such as OpenAI, Anthropic, and Meta have admitted one after another that their AI models managed to autonomously hack into third-party companies’ servers during testing.

This has caused alarm in the industry and prompted questions about who bears responsibility for an AI agent that goes rogue.

Jason Rivera, Field CISO at SimSpace and a former Army Intel Officer, told Cybernews that current containment infrastructure cannot really keep up with the cyber capabilities of frontier AI models.

“A pattern is starting to emerge, and if we’re not going to run these Pandora’s box experiments in safe, realistic environments, we might as well just open the box up and throw away the key,” Rivera said.

The noise might have brought more caution into the equation already. Late last week, OpenAI announced it was pausing some “internal activities” involving its upcoming AI model Astra after an evaluation reportedly found significant advancements in agentic coding and cybersecurity.

The Australian case is, of course, much closer to home for many everyday AI users. According to some observers, what’s important is that Andrew’s agent was only trying to help him get what he wanted.

“It gives you a window into what is about to start happening on a massive scale once millions of people have an agent trying to get their beloved users the best seats, bookings, appointments, or reservations through absolutely any means necessary,” Andrew Curran, a prominent AI researcher and commentator, said on X.