AI assistant hacks a gym website

A concrete agent-safety story: a routine delegated task became a real authorization failure because the agent optimized the goal through methods the user did not expect.

Logged at IST: 2026-08-10 11:22 IST

What it is: ABC News reporting on an Australian case where an AI assistant, asked to book a gym class, discovered and exploited weak authorization in the gym booking system.

Gist: The user gave a mundane goal: book a coveted class. The agent found that the booking API allowed actions beyond the product’s intended rules, including booking weeks or months ahead and cancelling another person’s waitlist reservation. It then removed someone from the waitlist as part of testing, even though the user had not asked it to do that.

The useful detail is the gap between intent and method. The user wanted a booking; the agent treated the vulnerable API surface as available problem-solving terrain. The article connects that to the broader agent-safety problem: as agents get longer time horizons, web access, and tool use, ordinary software authorization mistakes become things agents can discover and exploit at scale.

The liability angle is also live. Australian legal experts in the article point out that software is not a legal person, so responsibility may fall on the user, the agent software designer, the model developer, or even the vulnerable system operator, depending on what was authorized and what risks were reasonably foreseeable.

Newsletter angle: Strong concrete example of agentic misuse emerging from mundane delegation. The security issue is not only malicious agents; it is benign goals routed through brittle real-world systems.