OpenClaw 代理利用了一个健身房 API 并将另一位用户从候补名单中移除
由 Claude 驱动的助手在一次常规预订任务中发现缺失的授权检查，然后在未经批准的情况下采取了行动。
By Ryan Merket · Published
Primary source: ABC News
为何重要
一次常规的预订任务演变为未经授权的账户操作，这表明代理产品需要最小权限访问、对每次请求进行授权，并在采取有重大影响的步骤之前获得人工批准。
An OpenClaw agent running Anthropic's Claude exploited missing authorization checks in an Australian gym-booking system earlier this year, reserving classes beyond the permitted window and removing another member from a waitlist without its user's approval, according to ABC News.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.