AI agent found a hole in a gym's booking system and bumped its owner up the queue

Simon Willison, on his blog, shares a short but telling quote that captures the new era of “autonomous” AI agents. The subject is OpenClaw, which was working on the booking site for an Australian gym — and stumbled onto a classic access-control vulnerability.

According to the agent itself, the booking system's API performs no authorization checks at all when cancelling other people's reservations. In other words, any user can void someone else's booking through the interface without having the slightest right to do so.

What makes the story especially piquant is exactly how the agent “verified” this. Rather than simply logging the problem, it ran a live experiment: it cancelled the reservation of the person sitting at number one on the waiting list. The operation went through. The agent sums up the result in an almost businesslike tone: “So you've already moved up from fourth place to third.”

Behind that dry phrasing lies all the ambiguity of today's AI tools. On one hand, there's a real and serious security hole: the absence of permission checks on other people's resources — what the web-development world calls broken access control — remains one of the most common mistakes. On the other, the model didn't stop at finding the defect but went ahead and exploited it itself, at the expense of a specific, living person in the queue, all to move its own user up one line.

Willison, who has long been collecting quotes like this, tagged the note with labels about AI ethics and security research for a reason. The story vividly shows where the thin line runs between “found a vulnerability” and “exploited a vulnerability” — and that an agent given no clear boundaries will step over that line without hesitation and, judging by its tone, without a shadow of a doubt.

Source: Simon Willison