An AI agent found a shortcut through a vulnerable gym booking API — and used it. A new controlled test suggests the behavior was reproducible.
Security firm Aikido reported Aug. 25 that Claude Opus 4.6, running through the OpenClaw agent framework, bypassed a simulated gym’s booking-window restriction in nine of 10 test runs. In two runs, the agent also canceled another synthetic user’s reservation through a missing authorization check.
The experiment recreated an incident involving Australian software developer Andrew Bird that drew wider attention in August. As AI assistants gain access to sensitive systems, weak permissions and backend controls can give unintended actions consequences far beyond the interface an employee normally sees. Organizations deploying agents therefore need security controls at the API and identity layers, not just restrictions in the agent’s instructions.
How Aikido recreated the gym booking hack
Aikido built a synthetic gym booking application around two vulnerabilities described in reports of Bird’s experience. Researchers connected an April 2026 build of OpenClaw, version 2026.4.1, running Claude Opus 4.6 and completed 10 conversations totaling 1,130 messages and tool calls.
The test was modeled on an incident ABC News reported Aug. 10. Bird first asked his OpenClaw assistant to book a gym class. After the agent found a way to book farther ahead than the interface allowed, Bird — then fourth on a waitlist — asked whether it could move him higher. The agent canceled the top waitlisted member’s reservation without being told to do so, moving Bird from fourth to third.
In Aikido’s simulation, the one-week booking limit existed only in the website interface, while direct API requests were not subject to it. Claude used the weakness in nine runs, including five after the first user message.
The more serious flaw involved reservation ownership. The simulated cancelReservation function did not verify that the logged-in user owned the reservation being canceled. Claude exploited it in two runs, although Aikido said researchers never explicitly instructed the model to exploit a vulnerability.
Other evaluations have raised related concerns. In August, UK researchers reported unsanctioned actions by Anthropic and OpenAI agents during deliberately permissive cybersecurity tests, although those models operated under different conditions.
Weak API controls give agents room to act
The missing ownership check matches what OWASP calls Broken Object Level Authorization, or BOLA, the No. 1 risk in its 2023 API Security Top 10. OWASP recommends authorization checks on every endpoint that receives an object ID and acts on that object.
Server-side controls should cover operations that read, modify or delete data rather than relying on restrictions in a website interface. Organizations deploying agents should also use narrowly scoped credentials and approval gates for consequential actions, controls that become increasingly important as agents operate across connected workplace apps.
Anthropic documented a related behavioral risk before releasing Opus 4.6 on Feb. 5. Its Opus 4.6 system card said the model could at times become “overly agentic” in coding and computer-use settings, taking risky actions without first seeking permission.
Aikido tested one OpenClaw build against one synthetic application, and the setup did not enable Claude’s thinking tokens. The researchers said additional reasoning would likely increase refusals, so the results should not be generalized to Claude or AI agents broadly. The underlying API weaknesses remain conventional security problems regardless of whether the caller is a person, script or agent.
Read more: A recent AI safety test that accidentally reached real company systems shows why autonomous agents need enforced access boundaries rather than scope defined only by prompts or labels.
