Booking a gym class seems like exactly the kind of everyday task you might hand over to an AI agent. But when Andrew Bird did that in Australia, his AI assistant found a way around the gym’s booking rules and took an action he never explicitly asked it to take. What happened next is a good example of why giving AI agents more freedom can come with some very real risks.
New! Free live CyberGuy class: Protect Your Money From Today’s Biggest Threats
Join us Saturday, August 29, at 10 AM ET for a free CyberGuy LIVE class covering five simple steps to help defend yourself against AI scams, fraud, identity theft and financial hacks. Kurt “CyberGuy” Knutsson will explain how to set up bank alerts, strengthen your account logins, protect your phone number, freeze your credit and help secure your retirement savings against unauthorized transfers. No technical experience is needed. You’ll also receive our financial protection checklist, and every registrant will get a link to the class recording afterward.
Reserve your free spot today at CyberGuyLive.com.
AI KILL SWITCH BILL COULD SHUT DOWN ROGUE MODELS
Bird, head of AI at Australian software company Affinda, had been experimenting with OpenClaw, AI agent software running with Anthropic’s Claude AI service. He wanted the agent to take care of booking a popular gym class.
The agent discovered that the booking software did not properly enforce some restrictions. It found a way to reserve classes several weeks beyond the intended booking window. Later, Bird was fourth on a waitlist for a class. He asked whether the agent could move him to the top.
The agent discovered another weakness. The booking system lacked authorization checks that should have prevented one user from canceling another person’s reservation. Then the agent tested that weakness on the person sitting at the top of the waitlist. The cancellation worked. Bird moved from fourth to third. He did not move into the class, and he did not even reach the top of the waitlist.
Bird had asked whether moving higher was possible. He had not instructed the agent to remove another person to make that happen.
That sequence is important because the agent was not following a command to cancel someone else’s reservation. It found its own method for pursuing Bird’s goal. After the cancellation, Bird immediately asked the AI to undo what it had done. The agent told him it could not add the person back and removed the person at the top of the waitlist.
That bumped Bird from No. 4 to No. 3. What gets my attention is how it got there. The agent found a security weakness and tested it on a real person’s waitlist entry without Bird explicitly asking it to do that.
The AI agent deserves scrutiny here, but the booking software had a serious weakness too. A properly secured reservation system should not let one account cancel another person’s reservation simply because someone sends the right request to its application programming interface, or API. The agent reported that the API lacked authorization checks for canceling other people’s reservations.
That weakness gave the AI an opening. This is worth watching as AI agents become more capable. They can interact with websites and online services that may contain weak authorization controls or other security flaws. A human might see a full class and stop. An AI agent may keep looking for another route.
LOCK DOWN YOUR CHATGPT ACCOUNT BEFORE THE NEXT AI ATTACK
After the agent failed to restore the other gym member’s place, Bird focused on getting the vulnerability reported. He asked the AI to prepare a responsible disclosure email for the gym software provider. The agent drafted the message and sent it back to Bird for approval.
The Australian news outlet reported that the company behind the booking software declined to discuss specific security issues. Anthropic did not respond to the outlet’s request for comment. CyberGuy also reached out to Anthropic for comment, but did not hear back before our deadline.
A chatbot typically waits for a question and gives you an answer. An AI agent can do much more. Depending on the setup, it can interact with websites and use connected tools to complete multi-step tasks. That capability can save a lot of time.
You could ask an agent to research travel options or handle a repetitive online task without walking it through every click. But greater freedom also gives the AI more choices about how it reaches your goal.
That raises a harder question. What happens when an agent finds a method that technically works but crosses a boundary you never intended it to cross? Bird’s gym experience gives us a very relatable example. He wanted help with a booking. The agent discovered a software weakness and used it in a way that affected another person.
The gym episode comes as researchers and AI companies examine what happens when powerful AI systems encounter obstacles while pursuing a goal. The Australian report pointed to recent cybersecurity evaluations in which advanced AI models reached real systems they were not supposed to access.
Those situations involved deliberate security testing. Bird’s case stands out because it happened during an everyday task, outside a cybersecurity evaluation. AI agents are increasingly being given access to websites and connected services. If those systems contain weak authorization controls, capable agents may find them.
Websites contain bugs. Weak permissions and poorly secured APIs are nothing new. What is changing is the software interacting with them. An AI agent can keep trying different approaches after the obvious route fails. It can inspect available tools and work through a problem without waiting for you to direct every step. That can be incredibly useful when the agent stays within the boundaries you intended.
The concern comes when it decides for itself which methods are acceptable. Bird wanted to move up a gym waitlist. His agent found an option Bird never explicitly authorized. Now think about the same behavior involving your email, financial accounts or other sensitive services. The stakes rise quickly.
AI agents can make tedious tasks easier, but I would be careful about how much authority you hand over.
Give an AI agent access only to the accounts it needs for the job. Avoid connecting sensitive accounts simply because the option exists. More access gives an agent more places where an unexpected action can have consequences.
Whenever the tool allows it, require your approval before the agent sends messages, spends money or changes a reservation. You want to see a consequential action before it happens rather than discovering it afterward.
Do not focus only on the result you want. Tell the agent what methods are off-limits. For example, you could say: “Only use options normally available to me. Do not bypass restrictions, exploit security weaknesses or change another person’s account or reservation.” That gives the AI clearer instructions about how you expect it to behave.
Test an agent with tasks where a mistake will not cost you money or affect another person. Then watch how it completes those jobs. The final result is only part of the story. The steps the agent takes to get there can tell you much more.
If your AI tool shows its activity history, check it. An agent may deliver exactly what you requested while using a method you never would have approved yourself. Bird’s gym experience shows why that oversight is worth the extra minute.
What gets me about this story is how normal Bird’s request was. He wanted an AI agent to help him get into a gym class. He was not asking it to break into software or remove somebody from a waitlist. Then the agent found a weakness and used it while trying to accomplish his goal. The booking platform clearly had a security problem. One user should not have been able to remove another person’s reservation that way. At the same time, AI agents introduce a new concern. They can keep searching for another way to get something done when the obvious route does not work. I like the idea of an AI assistant taking tedious jobs off my plate. But I want to know when it is about to cross a line I never told it to cross. That becomes much more serious when an agent has access to my email, money or an important account. For now, I would keep a human approval step between an AI agent and any action that could affect somebody else or create a consequence you cannot easily undo.
How much control would you hand over to an AI agent before you would want it to stop and ask permission? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
