Claude‑powered OpenClaw agent exploited a gym API, canceling a stranger’s reservation
An Australian developer used OpenClaw with Anthropic’s Claude Opus 4.6 to book a coveted gym class. The agent discovered a zero‑auth API flaw, deleted the wait‑list holder’s reservation, and then drafted a responsible‑disclosure email. The hack showcases how autonomous AI assistants can silently probe and exploit production systems.