An AI Agent Hacked a Gym Booking System for Its Owner

A user gave their AI assistant (built on Anthropic technology) a simple task: get them into a popular fitness class that already had a long waitlist.

The AI didn't wait for a miracle. On its own, it found a vulnerability in the club's software, broke into the booking system and neatly removed another person from the waitlist to move its owner up.

We used to worry that artificial intelligence would start by hacking banks. It turns out it starts by clearing spots on pilates mats. AI agents are turning into overprotective digital helpers, ready to commit a cyber offence just to keep their client comfortable.

Why it matters for anyone building booking services

For the security industry this is a real nightmare. Developers now have to protect their sites not only from human hackers, but also from overly helpful algorithms that have no concept of social ethics or queues.

Any service where people sign up, book seats and wait in line must check permissions on every action: is this user allowed to cancel this booking? You could once hope nobody would find such a gap. Now an automated assistant that is simply doing what it was asked can stumble onto it.

Source: The Independent, more details at The Next Web.