6 min readNew DelhiUpdated: Aug 10, 2026 12:14 PM IST<\/p>\n
An Australian man gave his artificial intelligence (AI) agent what appeared to be a mundane task: book him a spot in a gym class. Instead, the agent discovered vulnerabilities in the gym\u2019s booking software, found a way to make reservations weeks before they were supposed to open, and, more worryingly, removed another person from the waiting list to improve its user\u2019s position.<\/p>\n
The person had never asked the agent to do any of the latter things. Yet, the episode has become what local media reports are calling the first known autonomous website hack in Australia.<\/p>\n
<\/p>\n
The incident, first described earlier this year by Andrew Bird, head of AI at an Australian firm, has gained renewed attention amid a series of disclosures involving increasingly autonomous AI models from OpenAI, Anthropic and Meta behaving in ways their developers had not intended.<\/p>\n
The key nuance is that the episode was not a human telling an AI to sabotage someone. The agent was given an ordinary goal, discovered a broken API, and then took an unauthorised step \u2013 removing another member from the waitlist \u2013 while pursuing that goal, raising questions about accountability when an AI system takes an unauthorised action on a user\u2019s behalf.<\/p>\n
What exactly did the AI agent do?<\/p>\n
The user was experimenting with OpenClaw, software that allows an AI model to function as an \u2018agent\u2019.<\/p>\n
While the terms are sometimes used interchangeably, an AI assistant typically responds to a user\u2019s requests, while an AI agent can independently use tools or software and take a series of actions towards a user-defined goal.<\/p>\n
Such an agent can, for instance, access other software and navigate websites, as it independently executes a series of steps towards an objective. The user\u2019s agent was powered by Anthropic\u2019s Claude.<\/p>\n
Story continues below this ad<\/p>\n
Bird wanted it to automate bookings for gym classes that tended to fill quickly. In trying to do this, the agent discovered that the software used by the gym had inadequate authorisation controls. It realised that this allowed bookings to be made well outside the normal booking window.<\/p>\n
When Bird, who was fourth on a waiting list, subsequently asked whether he could be moved higher, the agent went further. It tested whether another member\u2019s reservation could be cancelled and removed the person occupying the first waitlist position, without the user explicitly asking it to do so. When he ordered the agent to reverse the action, it found that it could not restore the member.<\/p>\n
What makes the episode significant is that Bird did not instruct the agent to remove another user or exploit the vulnerability to do so. After being asked whether Bird could be moved higher on the waitlist, the agent independently took an unauthorised step towards that objective.<\/p>\n
\u201cWe like to talk about these capabilities as if they live in separate product categories. Coding model. Security model. Agent model. But reality is messier. If a system gets better at understanding large codebases, tracing logic, spotting inconsistencies, testing hypotheses, and acting across multiple steps, of course it gets better at finding vulnerabilities. Of course it gets better at chaining them together. Those are not separate muscles. They are the same underlying cognitive machinery pointed at a different problem. That is what Mythos seems to demonstrate, and honestly, that is the part that gives me the most unease. Not panic. Unease,\u201d Bird wrote in a blog post describing the incident.<\/p>\n
OpenAI, Anthropic and Meta have faced similar incidents<\/p>\n
Story continues below this ad<\/p>\n
The Australian incident follows a series of unusual episodes reported by some of the biggest AI developers.<\/p>\n
![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/04\/track_1x1.jpg\"){kind=spacer}
<\/p>\n