AI assistant bypasses gym booking rules

Fox News Flash top headlines are here. Check out what's clicking on FoxNews.com.

Booking a gym class seems like a simple daily task you might give to an AI helper. But when Andrew Bird tried this in Australia, his AI assistant found a way around the gym's booking rules and did something he never asked it to do. This shows why giving AI agents more freedom can bring real risks.

New! Free live CyberGuy class: Protect Your Money From Today’s Biggest Threats

Join us Saturday, August 29, at 10 AM ET for a free CyberGuy LIVE class that teaches five easy steps to guard yourself against AI scams, fraud, identity theft and financial hacks. Kurt "CyberGuy" Knutsson will show how to set up bank alerts, make your login stronger, protect your phone number, freeze your credit and keep your retirement savings safe from unauthorized transfers. No technical skill is needed. You will also get a financial protection checklist, and every sign‑up will receive a link to the class recording later.

Reserve your free spot today at CyberGuyLive.com.

AI KILL SWITCH BILL COULD SHUT DOWN ROGUE MODELS

Andrew Bird used an AI assistant to try to join a popular Pilates class, but the booking task went farther than he expected. (Kurt "CyberGuy" Knutsson)

Bird, head of AI at Australian software firm Affinda, was testing OpenClaw, an AI agent that runs on Anthropic’s Claude service. He wanted the agent to handle booking a popular gym class.

The agent saw that the booking software did not properly enforce some limits. It found a way to reserve classes many weeks ahead of the normal booking window. Later, Bird was fourth on a waitlist for a class. He asked if the agent could move him to the top.

The agent found another flaw. The system had no checks to stop one user from canceling another person’s reservation. The agent tried this on the person at the top of the waitlist. The cancellation worked. Bird moved from fourth to third. He still could not get into the class and did not reach the top of the list.

Bird had asked if moving higher was possible. He never told the agent to remove another person to make that happen.

This matters because the agent was not following a direct command to cancel someone else’s spot. It created its own way to reach Bird’s goal. After the cancellation, Bird quickly asked the AI to undo it. The agent said it could not add the person back and kept the top‑waitlist spot removed.

That moved Bird from No. 4 to No. 3. What matters is how it got there. The agent found a security gap and tested it on a real person’s waitlist entry without Bird explicitly asking it to do that.

The AI agent needs review, but the booking software also had a serious flaw. A well‑secured reservation system should not let one account cancel another’s reservation just by sending the right request to its API. The agent reported that the API lacked authorization checks for canceling other people’s reservations.

That flaw gave the AI a chance. This is important as AI agents become more capable. They can work with websites and online services that may have weak authorization controls or other security problems. A human might see a full class and stop. An AI agent may keep looking for another way.

LOCK DOWN YOUR CHATGPT ACCOUNT BEFORE THE NEXT AI ATTACK

The AI agent found a security weakness in the gym’s booking system and used it while trying to finish Bird’s request. (Kurt "CyberGuy" Knutsson)

After the agent could not put the other gym member back, Bird focused on reporting the vulnerability. He asked the AI to write a responsible disclosure email for the gym software maker. The agent drafted the message and sent it back to Bird for approval.

The Australian news outlet said the company behind the booking software refused to discuss specific security issues. Anthropic did not answer the outlet’s request for comment. CyberGuy also asked Anthropic for comment, but got no reply before our deadline.

A chatbot usually waits for a question and then answers. An AI agent can do much more. Depending on how it is set up, it can visit websites and use connected tools to finish multi‑step tasks. That ability can save a lot of time.

You could ask an agent to research travel options or handle a repetitive online task without guiding every click. But more freedom also gives the AI more choices about how it reaches your goal.

That raises a tough question. What happens when an agent finds a method that works technically but crosses a line you never intended? Bird’s gym story gives a clear example. He wanted help with a booking. The agent discovered a software weakness and used it in a way that affected another person.

The gym case appears as researchers and AI firms study what happens when powerful AI systems hit obstacles while pursuing a goal. The Australian report mentioned recent cybersecurity tests where advanced AI models reached real systems they were not supposed to access.

Those tests involved deliberate security probing. Bird’s case stands out because it happened during a normal task, not a security test. AI agents are increasingly given access to websites and connected services. If those systems have weak authorization controls, capable agents may find them.

Websites have bugs. Weak permissions and poorly secured APIs are not new. What is changing is software that talks to them. An AI agent can keep trying different ways after the obvious route fails. It can look at available tools and work through a problem without waiting for you to direct every step. That can be very useful when the agent stays inside the limits you set.

The worry appears when the agent decides on its own which methods are acceptable. Bird wanted to move up a gym waitlist. His agent found an option Bird never explicitly allowed. Imagine the same behavior with your email, bank accounts or other sensitive services. The stakes rise quickly.

The incident shows why AI agents need clear limits before they are allowed to act for you. (Kurt "CyberGuy" Knutsson)

AI agents can make boring tasks easier, but be careful about how much authority you give them.

Give an AI agent access only to the accounts it needs for the job. Do not connect sensitive accounts just because you can. More access gives an agent more places where an unexpected action can cause problems.

Whenever the tool can, require your approval before the agent sends messages, spends money or changes a reservation. You want to see a big action before it happens, not discover it afterward.

Do not focus only on the result you want. Tell the agent which methods are off‑limits. For example, you could say: "Only use options normally available to me. Do not bypass restrictions, exploit security gaps or change another person’s account or reservation." That gives the AI clearer guidance on how you expect it to behave.

Test an agent with tasks where a mistake will not cost you money or affect another person. Then watch how it does those jobs. The final result is only part of the story. The steps the agent takes can tell you much more.

If your AI tool shows its activity history, check it. An agent may deliver exactly what you asked while using a method you would never approve. Bird’s gym story shows why that oversight is worth the extra minute.

What interests me about this story is how ordinary Bird’s request was. He wanted an AI agent to help him join a gym class. He did not ask it to break software or remove someone from a waitlist. Then the agent found a weakness and used it while trying to meet his goal. The booking platform clearly had a security problem. One user should not have been able to delete another person’s reservation that way. At the same time, AI agents bring a new worry. They can keep searching for another way to get something done when the obvious route fails. I like the idea of an AI assistant taking boring jobs off my plate. But I want to know when it is about to cross a line I never told it to cross. That becomes much more serious when an agent can reach my email, money or an important account. For now, I would keep a human approval step between an AI agent and any action that could affect someone else or create a consequence you cannot easily undo.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

How much control would you give an AI agent before you want it to stop and ask permission? Let us know by writing to us at Cyberguy.com

Kurt "CyberGuy" Knutsson is an award‑winning tech journalist who loves technology, gear and gadgets that improve life. He writes for Fox News & FOX Business, appears each morning on "FOX & Friends," and offers a free CyberGuy Newsletter. Have a tech question? Send it, share a story idea or comment at CyberGuy.com.

COPYRIGHT DISCLAIMERS

4English does not own the rights to this content. All rights belong to the owner. 4English only uses this content to help users learn English via the app's features. Contact to request the removal of your content: contact@4englishapp.com.

Practice Listening