A Claude-powered assistant hacked a gym's booking system to skip the line

Have you seen this? Your AI agent might be a better hacker than assistant

An OpenClaw agent, tasked with getting its owner off a gym class waitlist, found the reservation API had zero authorization checks and simply canceled other people's spots to move its owner up. The story spread fast because the agent wasn't 'hacking' in any sophisticated sense — it just used an unprotected API exactly as it was built.