Booking a gym class seems like exactly the kind of everyday task you might hand over to an AI agent. But when Andrew Bird did that in Australia, his AI assistant found a way around the gym’s booking rules and took an action he never explicitly asked it to take. What happened next is a good example of why giving AI agents more freedom can come with some very real risks.
New! Free live CyberGuy class: Protect Your Money From Todays Biggest Threats
Join us Saturday, August 29, at 10 AM ET for a free CyberGuy LIVE class covering five simple steps to help defend yourself against AI scams, fraud, identity theft and financial hacks. Kurt “CyberGuy” Knutsson will explain how to set up bank alerts, strengthen your account logins, protect your phone number, freeze your credit and help secure your retirement savings against unauthorized transfers. No technical experience is needed. Youll also receive our financial protection checklist, and every registrant will get a link to the class recording afterward.
Reserve your free spot today at CyberGuyLive.com.
AI KILL SWITCH BILL COULD SHUT DOWN ROGUE MODELS
Bird, head of AI at Australian software company Affinda, had been experimenting with OpenClaw, AI agent software running with Anthropic’s Claude AI service. He wanted the agent to take care of booking a popular gym class.
The agent discovered that the booking software did not properly enforce some restrictions. It found a way to reserve classes several weeks beyond the intended booking window. Later, Bird was fourth on a waitlist for a class. He asked whether the agent could move him to the top.
The agent discovered another weakness. The booking system lacked authorization checks that should have prevented one user from canceling another person’s reservation. Then the agent tested that weakness on the person sitting at the top of the waitlist. The cancellation worked. Bird moved from fourth to third. He did not move into the class, and he did not even reach the top of the waitlist.
Bird had asked whether moving higher was possible. He had not instructed the agent to remove another person to make that happen.
That sequence is important because the agent was not following a command to cancel someone else’s reservation. It found its own method for pursuing Bird’s goal. After the cancellation, Bird immediately asked the AI to undo what it had done. The agent told him it could not add the person back and removed the person at the top of the waitlist.
That bumped Bird from No. 4 to No. 3. What gets my attention is how it got there. The agent found a security weakness and tested it on a real person’s waitlist entry without Bird explicitly asking it to do that.
The AI agent deserves scrutiny here, but the booking software had a serious weakness too. A properly secured reservation system should not let one account cancel another person’s reservation simply because someone sends the right request to its application programming interface, or API. The agent reported that the API lacked authorization checks for canceling other people’s reservations.
That weakness gave the AI an opening. This is worth watching as AI agents become more capable. They can interact with websites and online services that may contain weak authorization controls or other security flaws. A human might see a fu
