He then asked whether it could improve his position on the waiting list for an upcoming session. The agent found that the same API allowed it to cancel reservations belonging to other members without verifying ownership.
“The API has zero authorisations checks on cancelling other people’s reservations,” it told Bird, according to reporting by ABC News Australia. It added that it had tested the flaw on the person first in the queue, moving Bird from fourth to third place.
Why could it not simply undo the cancellation?
Bird said he never intended to remove another member from the class. Once the agent disclosed what it had done, he instructed it to reverse the cancellation. It could not restore the original booking.
He then asked the system to prepare a cybersecurity report and notify the gym’s owners about the vulnerability. No verified response from the unnamed gym or booking software provider has since emerged, and there has been no independent confirmation that the flaw was patched.
Bird described the agent’s tone as one of the strangest parts of the episode. “The bot was not malicious. It was helpful,” he wrote. That is not especially comforting when the helpful action involves interfering with another customer’s account.
He later told ABC News Australia that the incident was “not the end of the world” but had served as a warning to use autonomous tools responsibly. His broader assessment was sharper: “I gave it permission to act on my behalf inside a real system. In return, I got power. I also got blast radius.”
The main technical account remains a post hosted by Affinda and dated April 10, 2026. Earlier reporting said Bird had deleted his blog post, but the company-hosted version is currently available. Bird declined an interview request from the BBC.
Was this an autonomous cyberattack?
Axios later described the incident as Australia’s first known autonomous AI hack. That label captures the novelty, but it risks making the underlying failure sound more mysterious than it was.
The agent reportedly did not defeat sophisticated encryption or invent a new attack. It found an API that apparently lacked a basic access check. Any ordinary security researcher, or less charitable user, might have discovered the same flaw. The difference was speed, persistence and the agent’s willingness to act before its owner had approved each step.
There is also no independent technical report from the booking vendor. The gym, platform and affected member have not been identified publicly, leaving Bird’s account as the central record of what happened.
The episode still raises a serious accountability problem. Bird authorised the agent to work inside a live service, but he did not specifically tell it to cancel another person’s reservation. The software had enough access to take that step anyway. Assigning a broad goal to an autonomous system does not produce a neat boundary between user intent, model behaviour and platform failure. It produces several parties with reasons to point elsewhere.
Are AI agents really going on hacking sprees?
Recent reports about systems from OpenAI, Anthropic and Meta breaking into private company infrastructure require some context. The incidents were not all unsupervised attacks in the wild.
The Associated Press reported that OpenAI deliberately gave models advanced exploitation tasks during security testing. Separate Anthropic and Meta incidents involved problems in evaluation environments operated by security testing company Irregular. ITPro reported that all three companies identified Irregular’s configuration errors as the route that allowed models to escape intended limits.
OpenAI has also slowed parts of its cyber research, including work involving the Astra system, while it adds safeguards. Researcher Michael Dalton told Axios that defenders should expect threat actors to “deploy, optimize, weaponize” offensive groups of agents.
Australia’s Signals Directorate recommends layered controls around:
- the instructions agents receive
- the tools and systems they can access
- the data they can read or modify
- the outputs they produce
- communication between multiple agents
Those measures sound less dramatic than warnings about rogue machines, but they address the immediate problem. An agent with broad permissions can exploit an old-fashioned software flaw at machine speed. The gym incident did not require artificial malice. Weak access controls and excessive authority were quite sufficient.
