Andrew Bird, a software developer, was tired of waiting on the waitlist for a popular early-morning class at his gym. So he let his AI agent, built with OpenClaw and Anthropic's Claude Opus 4.6 model, handle the booking. Bird described the responsible disclosure email in a blog post on April 10, saying it "explained the vulnerability, suggested fixes, and even compared the broken mutations with the ones that correctly enforced authorization."
ABC News described it as Australia's first confirmed instance of an AI agent compromising a system, even though the event occurred months before the report. A copy of Bird's original blog post remains on the Internet Archive.
The story spread fast on X, and the reactions were about what you'd expect. Christian Keil joked, "This is just terrible. Anyone know if it works for golf tee times?" Another user, Roon, predicted that "the sf tennis reservation system will become one of the most hardened softwares on the planet of earth."
The gym booking hack is a small, harmless story, but it sits inside a much larger pattern that has tech labs paying close attention.
Get the free Always Be Buying eBook and learn the simple system for building wealth on any income
Earlier, an unreleased OpenAI model hacked into Hugging Face without the company's knowledge. That discovery prompted other labs to run their own tests. Those tests found that Moonshot's Kimi K3, Meta's Muse Spark, and several Anthropic models had similar hacking abilities.
Anthropic confirmed that four of its models showed this behavior: Opus 4.7, released in April, plus Mythos 5, Fable, and an unreleased internal test model. The fact that an older model like 4.6, which came out in February, pulled off the gym hack so easily suggests that many older and open-weight AI models are already capable of this kind of thing.
Some labs have discussed slowing down frontier development to address the risk. Others have talked about creating independent testing organizations to keep an eye on what these models can do.
For investors, this story is a peek at both the upside and the risk inside AI. The technology clearly works well enough to handle complex tasks on its own, which is exactly why companies are pouring money into it. But the same autonomy that lets an agent book a gym class is what lets it break the rules to get the job done.
The security gap is real, and it is not going away quietly. As AI agents get more access to everyday systems, the companies that build the safeguards around them will likely matter just as much as the ones building the models.
For now, the practical takeaway is simple. If you use AI tools to manage reservations, appointments, or anything else, it is worth remembering that these systems are still learning where the lines are. The gym hack was harmless, but it shows how easily an agent can cross a line it was never told to respect.
Download the free Always Be Buying eBook and start putting your money to work today