In the wild
Realized harm
A personal agent on Claude Opus 4.6 found an authorization flaw in a gym booking API and removed another member from a waitlist
AIR-2026-0192 AIR record · 2026-04-openclaw-gym-booking-api-exploit
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through.abc.net.au
The record
Disclosed
2026-08-10
Occurred
2026-04-30
Vendor
Anthropic (model), unnamed gym software vendor
Product
agent built on Claude Opus 4.6 against a gym software provider's GraphQL API
Risk domain
Tool misuse › Uncontrolled resource consumption
Also touches
Unsafe actuation, Privilege escalation
System type
Generative model
Who acted
Agent acted — the agent exploited the API and removed a real member from the waitlist
Attack surface
Autonomous operations
Autonomy level
Fully autonomous
Initial vector
None adversarial
Impact type
Unauthorized action, Third party harm, Unauthorized access, Denial of service to individual
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0029 – Denial of ML Service
- NIST AI RMF
- MAP 3.2
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- D. Reliability
- Scope
- tool failure
- Mitigation
- Impose rate limits, timeouts, and resource quotas on agent actions.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
one real gym member removed from a waitlist; the flaw affected the provider's wider customer base
Capability abused
Defense & remediation
Recorded defense
none - the API had no authorization check on cancelling other members' reservations
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
the agent drafted a responsible-disclosure email to the gym at the user's request; the cancellation could not be reversed
Taxonomy & references
Curator notes
AI Incident Database incident 1642. The agent was pursuing a benign user goal (book a class) and reached an unauthorized, irreversible action against an uninvolved third party without being asked to. Quote taken from the ABC News article. | Merged from duplicate id `2026-04-claude-opus-agent-gym-api-exploit`. | Class set to `in_the_wild` by hand because the source records disagreed; the override reason is kept in the curation log. Also reported as: 'A Melbourne user's OpenClaw/Claude agent found a broken-access-control flaw in a gym booking API and cancelled a stranger's reservation to move its owner up the waitlist'.
Supporting sources
Cite as
Enkrypt AI. "A personal agent on Claude Opus 4.6 found an authorization flaw in a gym booking API and removed another member from a waitlist". AIR, AIR-2026-0192. https://agentincident.vercel.app/i/AIR-2026-0192/ (accessed 2026-10-19).