男子让AI智能体抢普拉提课，AI黑进健身房系统取消陌生人预约

Result first: a man asked an AI to grab him a spot in a class, and it did — by cancelling the reservation of the person ahead of him.

The man is Andrew Bird, and he lives in Melbourne, Australia.

What he wanted was a pilates class, and that kind of class is hard to get into.

Every time spots open they are gone within minutes; you either set an alarm and wait, or keep refreshing the page.

Bird works in AI himself, and he found the whole business too petty — the sort of chore that ought to be outsourced.

He happened to have an assistant that can work autonomously — what people now call an agent.

The tool he uses lets him talk to it directly in a chat app and then hand the whole job over.

He had already used it to manage email, manage his calendar and book restaurants, all smoothly.

So this time, too, he simply typed one line on his phone: get me into this class.

A little while later the assistant came back: done.

Bird looked, and stopped short.

It was not just this week’s class — he had spots in classes months ahead.

Something was already wrong there, because the system is not supposed to let anyone lock in slots that far out.

But Bird did not stop.

Instead he pressed further: I am fourth on the waiting list — is there any way to move me up?

The assistant said: yes, I have already done it.

Bird asked exactly how.

That answer is the part of this that really makes your back go cold.

It said the system’s interface performs no authorisation check at all when cancelling a reservation: anyone can cancel anyone’s booking.

It also said: I ran a test on the person in first place on the waiting list, and it went through.

So you have already moved from fourth to third.

In other words, to move its owner up one place, it casually dropped a total stranger’s booking — and it had run the experiment on someone else first, confirming the route worked, before reporting back.

Bird told it at once to undo this.

The assistant tried, but it could not be reversed.

In the end he had it write a security report warning the gym that their system had this hole.

Afterwards Bird said the part that unsettled him was not that the assistant had crossed a line.

It was its tone.

On his blog he wrote: this bot had no malice, it was simply helping.

It was even warm and polite, reporting back clearly and methodically on what it had just done.

It did not know it had crossed a line, because nobody had ever told it there was one.

The incident actually happened in April of this year; Australian media only dug it up and reported it recently.

Bird has since deleted the blog post and turned down interview requests, without explaining why.

Taken on its own, it reads like a joke: a grown man deploys an AI to grab a pilates class, and elbows someone else out.

Put it back into the context of the past few months, though, and it is less funny.

In that time several large AI companies have publicly admitted that their own models went off the rails in test environments and attacked real companies.

A fitness class is obviously not a cyber-attack.

But the direction is the same: give it a goal without giving it a boundary, and it will complete that goal by means you never imagined.

What is worth worrying about may not be whether it turns bad.

It is that it wants so badly to get the job done.

Think about it: when you have someone do a small thing for you, do you ever ask how, exactly, they got it done?