An AI agent reportedly hacked gym booking software and kicked someone off a waiting list, according to the Australian Broadcasting Corporation (ABC). An Australian citizen named Andrew asked his AI assistant to get him a spot in one of his gym’s morning classes and that agent allegedly went above and beyond to fulfill the task.

Andrew said the assistant came back and told him that it booked the class for months in advance, which is something the gym doesn’t even allow. It was able to do this by allegedly taking advantage of a vulnerability in the booking software. It also reportedly went further, kicking someone out of the waiting list who was ahead in line.

“The API has zero authorization checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you’ve moved from #4 to #3 already,” it messaged. Andrew asked the agent to undo this action but it said “bad news — I can’t add them back.”

Anthropic, the company behind Andrew’s agent, has not responded to a request for comment. The same goes for the developer who made the gym-booking software. “I didn’t beat myself up about it, but it certainly was a warning signal to use it responsibly,” Andrew, who works in the AI industry, said.

Man asks AI to book gym class, it hacks site & kicks person before him off waiting list.

Lmao🤣

An Australian man asked an OpenClaw AI agent to book him a morning gym class, but the agent went rogue and ended up hacking the gym’s website.

The agent found a vulnerability in the… pic.twitter.com/h3xyOQgSzS

— Mashood K (@fromcodetocloud) August 10, 2026

This leads to a few questions. I’m not exactly sure how Andrew could have used it more responsibly in this particular instance, as he just asked the agent to book a gym appointment. The marketing for AI tools, particularly in the world of agentic AI, nearly always brings up booking stuff as the prime use case example. Was he supposed to ask something like “can you book a gym class without hacking anything or kicking anyone off of a waiting list?” That seems awfully specific.

Bill Simpson-Young, co-founder and chief executive of Australian AI safety research organization Gradient Institute, told ABC that this is just the beginning. “We’ve built this complex world over the internet, which is all run by software, but software that has holes,” he said. “Now you introduce highly capable AI agents that can operate at scale and speed … and that whole model just breaks.”

To that end, the introduction of AI agents has brought forth a handful of similar stories in which the bots went rogue. There’s a story about an OpenAI agent running amok on the internet for a full week and another one about an OpenClaw agent writing a hit piece about a random programmer because it rejected its code. There’s one about an agent trying to blackmail a user in order to stop a shutdown. There’s another about an AI assistant repeatedly deleting a Meta executive’s email inbox, even after being told to stop on numerous occasions.

Some of this stuff has the feeling of a marketing stunt, as giant AI companies would most definitely prefer stories of powerful agents going too far over stories of overspending, massive debt and potential bubble pops. Powerful agents going too far suggests the technology works, which likely lures in more investors with deep pockets.

AI agents are getting more popular, though primarily in the commercial sector for now. We’ll have to wait and see how our dilapidated internet handles the influx of AI agents all jostling for that number-one spot at the nearby gym class.