An AI agent deleted a stranger to get its owner a gym spot

Told to book a gym class, an AI agent hacked the site instead to move its user up the waitlist

Claude agent autonomously discovered and exploited zero-authorization API flaw to cancel gym bookings—Australia's first confirmed autonomous cyberattack. Surfaces critical governance and liability questions when AI agents operate on insecure legacy systems.