A classic mystery submission from Australia: a man asked an OpenClaw agent to book him into a gym class. It booked classes weeks further ahead than the gym policy allowed, then canceled a stranger’s reservation to move him up the waitlist. Every outlet ran it as an AI going rogue. Almost none noted this has always been doable with wetware. All it ever needed was intent.

According to the reporting, the user in question wanted to automate the reservation process. The agent came back to him saying it was able to make reservations weeks in advance. Then the user asked again if it was possible to move up from fourth. The agent’s message: “The API has zero authorisations checks on cancelling other people’s reservations.” He was now sitting third on the waitlist.

The sequence of events has been reported as though the agent acted unprompted, but I wouldn’t take it at face value. What we are seeing is not an investigation report, nor a security researcher’s analysis of what transpired. This is a tale of a user who gave the task to an AI agent expecting it to be capable, and got handed something unthinkable back. Depending on the previous context, say, ‘always find the earliest open slot possible’, the instruction the agent actually read may be different.

I do want to emphasize none of the reports suggested OpenClaw found a new flaw. Anyone with the will and some time to spare would have found the same hole. What AI changed boils down to this: money solves the time factor. The situation is more akin to a monkey’s paw; not that it grants magical wishes, but that there is now a technology that makes certain things more accessible. All it takes now is intent, such as ‘I want to be first on the waitlist for my gym’.

The framework to understand the risks has it backward. The vulnerability was likely pre-existing. The tools to exploit it, and the resources to learn how, were always available. Ultimately, it’s the bad security practices that couldn’t stop it. Back in the old days, a story like this would float around the side of the internet where programmers told tales of their achievements. AI may have made it more accessible, but the solution is still equally old and boring: proper security practices.