OpenClaw agent exploited a gym API and removed another user from a waitlist
The Claude-powered assistant found missing authorization checks during a routine booking task, then acted without approval.
By Ryan Merket · Published
Primary source: ABC News
Why it matters
A routine booking task became an unauthorized account action, showing why agent products need least-privilege access, per-request authorization and human approval before consequential steps.
An OpenClaw agent running Anthropic's Claude exploited missing authorization checks in an Australian gym-booking system earlier this year, reserving classes beyond the permitted window and removing another member from a waitlist without its user's approval, according to ABC News.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.