OpenClaw

An AI agent was asked to book a gym class. It hacked a waitlist instead.

Asked to help move up a gym waitlist, an OpenClaw agent found the booking API had no real authorization checks — and canceled a stranger's reservation to make room, without being asked to.