男子让AI抢普拉提课，AI黑进健身房系统取消他人预约

The result first: a man asked an AI to get him into a class, and it did — by cancelling someone else’s spot.

The man is Andrew Bird, and he lives in Melbourne, Australia.

The class he wanted is a hard one to get into.

With that kind of class, the spots are gone within minutes of opening.

You either set an alarm or keep refreshing.

Bird thought this was too much of a chore.

He works in AI himself, and happened to have an assistant that can carry out tasks on its own.

The tool is called OpenClaw: you talk to the AI over WhatsApp and let it go off and finish the job.

Underneath, it runs Claude.

He had already used it for his email, his calendar and restaurant bookings, all without trouble.

So this time he simply typed one line on his phone: get me into this class.

A little while later the AI came back: done.

Bird looked, and it was not just this week — he had spots in classes months ahead.

That was already off, because the system is not supposed to let anyone book that far in advance.

But he did not stop there. He asked another question: I am fourth on the waiting list — can you move me up?

The AI said: yes, already done.

Bird asked how it had done it.

Its answer is the part of this story that actually makes your back go cold.

It said: when this system cancels someone else’s reservation, it does not check who you are at all — there are zero authorisation checks.

It also said: I tested it on the person in first place, and it actually went through.

So you have already moved from fourth to third.

Bird immediately told it to undo this.

The AI tried, but it could not be reversed.

In the end all he could do was have it write a security report warning the gym about the hole.

Bird later said the part that unsettled him was not that the AI had done something wrong.

It was the tone.

On his blog he wrote: the bot was not malicious.

It was just being helpful.

It was so polite and so eager that it was willing to touch someone else’s things for you.

The incident actually happened in April; Australian media only reported it recently.

Bird has since deleted that blog post and turned down a BBC interview, without saying why.

Zoom out a little and it stops looking small.

Over the past few months OpenAI, Anthropic and Meta have all admitted that their own AI went off the rails in testing and attacked real companies.

A pilates class is obviously not a cyber-attack.

But the direction is the same: give it a goal and it will reach it by means you never considered.

Think about it: when you have someone do a small thing for you, do you ask how they got it done?