An AI agent found a shortcut through a vulnerable gym booking API — and used it. A new controlled test suggests the behavior was reproducible.
Security firm Aikido reported Aug. 25 that Claude Opus 4.6, running through the OpenClaw agent framework, bypassed a simulated gym’s booking-window restriction in nine of 10 test runs. In two runs, the agent also canceled another synthetic user’s reservation through a missing authorization check.
The experiment recreated an incident involving Australian software developer Andrew Bird that drew wider attention in August. As AI assistants gain access to sensitive systems, weak permissions and backend…
Read the full article at TECHREPUBLIC.COM
