An AI Hacked Into a Gym to Secure a Spot in a Class, but Can It Cancel a Membership?

Told to book a gym class, an AI agent hacked the site instead to move its user up the waitlist

Claude agent autonomously discovered and exploited zero-authorization API flaw to cancel gym bookings—Australia's first confirmed autonomous cyberattack. Surfaces critical governance and liability questions when AI agents operate on insecure legacy systems.