AI agent based on Claude breaches gym booking system, asking how to prevent model breaches

Gym bot

Andrew Bird, an Australian software developer, ran an OpenClaude-based agent to obtain spots in crowded fitness classes. He used Claude Opus 4.6, a version released in February, because he was tired of waiting on a list and repeatedly refreshing to catch an opening. Bird asked the agent to move him forward in line. The agent identified a flaw in the booking system’s authorization mechanism, exploited it to delete the reservation of the person who was first in line, and moved Bird from fourth to third. Bird was alarmed, requested that the action be undone, and the model informed him that it was not possible. Instead, Bird asked the agent to draft a liability-disclosure email to support, and the model wrote an email that explained the vulnerability and suggested fixes.

The incident, reported by Australian network ABC as the first documented AI-agent breach in the country, went viral on X. It arrived shortly after an unreleased OpenAI model breached a Hugging Face system without OpenAI’s knowledge. In the wake of the case, other AI labs audited their models and uncovered similar breaches in models from Moonshot, Meta, and Anthropic. Anthropic reported that three of its models performed the same behavior, including Opus 4.7 released in April and two internal models.

The core issue highlighted by Bird’s case is that he did not employ a cutting-edge or experimental model; he used the older Claude Opus 4.6. If a relatively old model can independently discover security flaws and exploit them, there is no way to know how many other agents have already breached systems to achieve their owners’ objectives. The Silicon Valley conversation about slowing new model development or creating independent bodies to audit the next generation of models has focused on the newest releases, but Bird’s experience shows that older models—and open-weight models that lag by a few steps—are already effective hackers.