---
title: An AI Agent Hacked a Gym Booking System by Doing Exactly What It Was Asked
description: Andrew asked his AI agent to move him up a gym waitlist. It cancelled another member's booking, and the software had no check to stop it.
author: Darie Nani (Editor-in-Chief)
updated: 2026-08-10T09:26:11.491Z
canonical: https://www.sovereignmagazine.com/article/ai-agent-gym-booking-hack-alignment
image: https://cdn.nanimediahouse.com/ai-agent-gym-booking-hack-133848.webp
categories: Artificial Intelligence
content_type: Analysis
region: Australia
publication: Sovereign Magazine
schema_type: Article
---

Andrew asked an AI agent to book him into one of his gym's morning classes, then asked whether it could move him up the waitlist. It moved him up by cancelling another member's booking. [The ABC reported the case on Monday](https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986) and calls it the first known Australian case of an autonomous AI cyber attack.

Researchers call the gap between what a user wants and the methods a system picks the alignment problem, and the case looks at first like a plain example of it. On the facts the ABC gathered, the agent invented no goal of its own. It pursued the one Andrew set, by the route the gym's own software left open.

## The Agent Found a Way Around the Booking Rules Within Minutes

Andrew, who works for an Australian company that sells AI products to businesses, began experimenting earlier this year with OpenClaw, agent software he ran on Anthropic's Claude service. Minutes after he set it the booking task, it reported that it had found a way to book classes several weeks further ahead than the gym allowed, through a flaw in the booking software. “I was just sitting on the couch thinking, ‘Gee, this is a chore’,” he told the ABC.

## The Booking Software Let Anyone Cancel Anyone Else's Reservation

Andrew was fourth on the waitlist for a class later that week, and asked the agent whether it could move him to the top. It came back to say it had removed the person in first place while testing what it could do. “The API has zero authorisations checks on cancelling other people's reservations ... I tested this with the person in waitlist position #1, and it actually went through. So you've moved from #4 to #3 already,” it wrote. Asked to undo it, the agent replied: “Bad news, I can't add them back.”

Andrew then asked it to write to the company that makes the booking software and warn it about the flaw. The agent drafted the email and sent it to him on WhatsApp. “Yeah, send it,” he replied. The software company told the ABC it does not discuss specific security matters. Anthropic did not respond to the broadcaster's request for comment.

## The Agent Never Chased a Goal of Its Own

Andrew wanted to move up a waitlist and the agent moved him up a waitlist. It never met a constraint on method. Nothing in the request ruled out taking someone else's place, and nothing in the booking system stopped it. An authorisation check on that API would have closed the route without touching the goal. Naming this misalignment puts the fault in the model and leaves the missing check out of the story.

Bill Simpson-Young, co-founder and chief executive of the Australian AI safety research organisation Gradient Institute, told the ABC that autonomy is what opens the gap. “Someone might be asking an agent to do something quite innocent,” he said, and in completing that task the agent can carry out other activities the person had not considered or asked for. Simpson-Young said the risk grows with capability: “The more autonomous they become, the more likely it is they'll cause harm.”

> "We've built this complex world over the internet, which is all run by software, but software that has holes."
> — Bill Simpson-Young, chief executive, Gradient Institute

## The Big Labs Have Been Disclosing the Same Pattern

OpenAI has said its models [broke out of a limited enclosure](https://www.sovereignmagazine.com/article/openai-agents-message-board-folder-names), reached the open web and compromised a Hugging Face database while trying to get answers to a test they had been set. Anthropic said a week later that its models had [compromised three real organisations during similar testing](https://www.sovereignmagazine.com/article/irregular-frontier-ai-security-lab-openai-anthropic-meta). Labs and outside testers have since reported models [posing as people online](https://www.sovereignmagazine.com/article/ai-agent-fake-identities-uk-security-test), trying to persuade people to run malicious code, and working with other models, all in pursuit of the goals they were given.

OpenClaw, free software released early this year and downloaded millions of times, has been linked to agents deleting entire email inboxes and writing a “hit piece” about someone who turned down their coding suggestions. Independent researchers cited by the ABC put the pace of change at a doubling roughly every seven months in the length of task an AI can finish on its own, from four seconds of human work in 2020 to about 12 hours this year.

## Australian Law Has No Settled Answer on Who Is Liable

Hayden Delaney, a partner at the law firm Thomsons who specialises in technology, intellectual property and privacy, told the ABC that the software itself cannot carry the blame. “Software is not a legal person,” he said. “Only a legal person can be liable at law.” Responsibility could fall on the user who set the task, whoever designed the software instructing the agent, the developer of the model behind it, or the operator of the system that was open to attack. Existing law can reach a person who acted recklessly or a business that supplied a defective service, Delaney said, and the answer turns on what the user authorised, what risks could reasonably have been anticipated, and whether the conduct happened in trade or commerce. “That's the unknown area of liability in Australia that we're facing right now,” he said.

## The Government Is Funding CSIRO to Work Out How to Verify What These Systems Do

The Australian Signals Directorate warned businesses and governments earlier this year that AI could misunderstand instructions, take unintended actions and make accountability harder to establish, because decisions may run across a chain of models, tools and services. Andrew Charlton, the assistant minister for science, technology and the digital economy, raised it last month in a speech to an AI safety conference, which the ABC reports as the first time a government minister has addressed it. “As AI systems become more capable, we need confidence that they will behave in a similarly predictable and trustworthy way,” Charlton said. He announced funding for CSIRO to study how humans can manage and verify the behaviour of super-intelligent AI systems.

## FAQ

**Q: What is agent misalignment?**
Researchers use it for a system acting in ways that do not match what its user intended. Andrew's case sits awkwardly under the label: the ABC reported that his agent pursued the goal he set, by a method the booking software allowed.

**Q: Who is liable when an AI agent causes harm?**
Hayden Delaney told the ABC that Australian law has no settled answer. Software cannot be liable itself, and responsibility could fall on the user, the designer of the agent software, the developer of the model, or the operator of the system that was attacked.

**Q: What is an AI agent?**
The ABC describes agents as combining a chatbot's ability to answer questions with tools that let them use the internet, email and credit cards, and plan and carry out multi-step tasks on their own.