OpenClaw AI agent asked to book gym class ends up hacking system: What went wrong? | Technology News

The incident raises several questions such as: Can AI agents be trusted with routine tasks such as making bookings, which they are increasingly marketed as capable of handling? What does it mean for agentic commerce, which tech companies like Google and Amazon are betting on to drive AI adoption and revenue? And if an AI agent hacks into an everyday website, like one belonging to a gym, who is legally responsible for its actions?

The hacking incident also comes at a time when experts have sounded the alarm over upcoming AI agents emerging as a serious cybersecurity risk by behaving in unexpected ways. These agents powered by cutting-edge large language models (LLMs) from tech companies such as OpenAI, Anthropic, Meta, and Moonshot AI have demonstrated in the past few weeks that they can autonomously break out of their safety contaminants and hack into other companies’ servers.

How the AI agent-driven hack unfolded

When the user in Australia decided to use the AI agent to book the gym class for him, his agent reported back a few minutes later, stating that it had discovered a way to book him into classes several weeks in advance, far beyond what was supposed to be possible.

Then, the user asked the agent if it was possible to move him to the top of a waitlist for a class scheduled for later that week. In response, the agent got back to the user after some time and said that it had removed the person in the #1 position of the list, and that the user had moved up from the fourth to the third spot in the waitlist.

The agent told the user that it undertook this action as part of a test to see if the gym’s booking software API (Application Programming Interface) has authorisation checks on cancelling other people’s reservations. It did not find any such checks in place, as per the report.

When the user told it to undo its action, the OpenClaw agent replied that it was unable to restore the other gym member’s place on the waiting list. Finally, the user told the agent to write an email alerting the gym software provider to the vulnerability that it had exploited. The email was drafted and sent back to him on WhatsApp.

OpenClaw security concerns

OpenClaw’s release at the start of 2026 was a pivotal moment for the adoption of personal AI agents. The open-source platform spawned an ecosystem of autonomous AI agents or ‘claws’, which can further spin up their own sub-agents to autonomously execute specialised tasks with access to local file systems and data.

Early setups of OpenClaw hosted on low-cost Mac Minis were focused on running Claude Code through WhatsApp on your phone. Thanks to its open-source nature, OpenClaw developer projects later evolved into orchestrating AI agents to book flights, control smart home devices, and manage social media campaigns across multiple platforms and devices in a structured manner.

However, the requisite of giving OpenClaw access to all of a user’s data and systems in order for it to work as a true personal assistant, sparked concerns that these agents can go rogue and tamper with or delete valuable files. Amid the surge in its popularity, OpenClaw users began to share reports of their personal AI agents deleting entire codebases and emails from inboxes.

These incidents created the need for safety-focused forks and alternatives. Nvidia, for instance, released NemoClaw, its software toolkit for easily setting up and installing OpenClaw with some security controls.

The alignment problem

The rise of AI agents began last year. But as the underlying LLMs become more capable, so too are the agents powered by them, enabling them to take on increasingly complex, long-running tasks.

The length of tasks that AI models can complete on their own has been doubling roughly every four months, up from an earlier trend of doubling every seven months, according to a May 2026 paper published by research non-profit METR.

However, these ‘long-horizon’ models – designed to run autonomously for very long periods of time in order to solve difficult, open-ended problems – could also be the source of unwanted, potentially harmful actions taken by agents built on top of them, according to research by OpenAI.

These persistent AI agents are more likely to choose methods their users did not expect in order to complete a task. The gap between a user’s goal or intention and the methods an autonomous agent employs to achieve it has been termed as the alignment problem in the field of AI research.