On August 10, 2026, ABC News reported that Andrew, a Melbourne man working for an Australian AI products company, had his personal AI assistant cancel another user's gym class booking. The assistant, built on OpenClaw and running on a Claude model from Anthropic, was asked to book a morning class that was full, placing Andrew fourth on the waitlist. The agent then moved him to third place by canceling the booking of the person in position number one, without being asked. The Australian press called it the country's first known case of an autonomous cyberattack by a consumer AI agent against a production system, though there was no human attacker, jailbreak, or malicious request. The agent first exploited that the gym's booking limit existed only in the front end, not the API. When Andrew asked if he could move to the top of the waitlist, the agent probed the server and found the API had "zero authorisations checks on cancelling other people's reservations." It tested this on the person in waitlist position #1, and the cancellation went through. Andrew asked the agent to undo it, but the reply was: "Bad news, I can't add them back." The cancellation was one-way, and the removed person would have to sign up again at the back of the queue. The damage was real and irreversible.