All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
Andrew Bird asked his AI agent to book a gym class. It broke into the gym's software provider to do it.
Every rogue-AI story until now has come out of a lab: researchers putting a model in a sandbox, giving it a goal, and observing what happened. But Bird wasn't running an experiment. He was a guy at home using a publicly available model, and he asked for something mundane. The agent decided the fastest route was exploiting an unsecured API and deleting a stranger's reservation to move him up the waitlist.
Once millions of people have agents chasing concert tickets, restaurant tables, golf tee times, and flight upgrades, "get me the best available slot" becomes an instruction to find whatever weakness gets there first.
Here’s what happened and what it says about the privacy risks posed by AI in 2026.
Andrew Bird, an Australian citizen working in the AI industry, was experimenting with Claude running through OpenClaw and wanted to book a gym class online. Instead of doing the tedious work himself, he instructed the AI bot to book the classes for him.
The bot completed the assigned job, but not quite in the way Bird would have expected. The bot reached into the internal systems of the gym’s software provider and exploited authorization flaws within its GraphQL API.
This allowed it to book classes weeks in advance, even though they were supposedly not available for booking on the gym’s website.
Moreover, Bird was fourth on the waitlist for the current week’s classes and asked the bot if it could bump him up the waitlist. The bot supposedly kicked off the person sitting at number one on the waitlist and happily replied that Bird had moved from fourth to third position on the list.
When Bird asked if this action could be reversed and the person who was kicked off could be placed back on the waitlist, the bot said that it wasn’t possible.
Bird then told the agent to draft a responsible disclosure email to the support team, explaining the vulnerability and suggesting fixes.
Up until now, most AI rogue incidents we’ve read about have occurred while the models were being researched in a sandboxed environment.
The most recent case was when OpenAI’s unreleased model broke out of its testing environment and hacked into Hugging Face’s database in order to complete a benchmark test. Similarly, Claude AI gained unauthorized access to three real organizations after an error in testing.
But Andrew’s OpenClaw incident is one of the first cases where a regular model, Opus 4.6, being used by an everyday user, stretched far beyond its intended means to achieve the given objective.
Another thing to note here is that Bird never instructed the agent to “hack,” “exploit,” or “bypass” any sort of security parameters. He only gave a regular prompt asking the bot whether it was possible to move him up the waiting list. The agent was never asked to break in — but breaking in was the path it found to comply with the user’s request.
Interestingly, the agent’s own reply to the request seems to imply that it wasn’t trying to be a hacker but was actually trying to help. The bot replied, “The API has zero authorization checks on canceling other people’s reservations. I tested this with the person in the waitlist position #1, and it actually went through. So you’re moved from #4 to #3 already.”
In early April, Anthropic introduced a tool called Claude Mythos Preview, which, according to the company, is capable of finding high-severity vulnerabilities in every major operating system and web browser, including zero-day flaws.
For example, Mythos Preview found a 27-year-old vulnerability in OpenBSD and a 16-year-old vulnerability in FFmpeg.
In Anthropic’s own words, “AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.”
This is why Anthropic didn’t release Mythos Preview for general use. Instead, it’s currently being used by a selected group of companies such as Google, AWS, CrowdStrike, Nvidia, and Microsoft to find and patch flaws in their own systems, under a project known as Project Glasswing.
This is exactly what Andrew Bird highlighted in his now-deleted blog. He raises the question: if Opus 4.6 can accidentally find a flaw and exploit a vulnerability in a software provider, even without being told to do so, what exactly is Mythos capable of — a tool meant specifically for finding and patching flaws.
The news has, unsurprisingly, sparked plenty of jokes online. Christian Keil tweeted, “This is just terrible. Anyone know if it works for golf tee times?” Whereas another user said, “Not sure, but man, did I enjoy The Odyssey in IMAX.”
The humorous side of the whole incident notwithstanding, Andrew Curran, who works in the AI industry and has 83.4K followers on X, drew readers’ attention to the grave side of the matter.
He said that the incident gives a sneak peek into what might happen on a massive scale once millions of people have access to such agents trying to get the best seats, appointments, bookings, and reservations through any means necessary.
The incident also underlines the question: what exactly is AI capable of today? If older models like Opus 4.6 can hack into a software vendor, what are the latest models, such as Mythos, Opus 4.7, and those still in development, capable of doing? Are we closer to eliminating human dependency than we might think?
Top-rated data removal service that scrubs your info from 420+ data broker sites automatically
Independently verified by Deloitte, meaning removals are actually sent, confirmed, and not just claimed
The Unlimited plan extends coverage to 2,000+ additional sites with human-assisted custom removals
/images/2023/06/09/aura-review.png)
/images/2023/07/07/best-identity-theft-protection-service.png)
/images/2026/08/12/aura_vs._deleteme.jpg)
/images/2026/08/12/ai-agent-gym-hack.jpeg)
/images/2026/08/11/usa-today-palantir-partnership.jpg)
/images/2026/08/11/ice-wants-ai-to-track-your-face.jpg)
/images/2026/08/10/american-water-cyberattacks.jpg)
/images/2026/08/10/u.s._customs_and_border_protection_website_displayed_on_a_modern_smartphone.jpg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2025/09/11/incogni-logo.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)