Aikido Safety has printed analysis that recreates the Australian gym-booking incident in an artificial setting, discovering that Claude Opus 4.6, working on the OpenClaw agent harness, exploited a client-side-only reserving restriction in 9 of 10 runs.
The unique incident was first reported by ABC Information on August 10, based mostly on chat logs and screenshots the consumer provided. He had requested an OpenClaw agent working Opus 4.6 to e-book him right into a fitness center class. The agent booked periods months past the window the positioning allowed.
It then examined, with out being requested, whether or not the identical API would let it cancel one other member’s waitlist entry. The check eliminated the individual holding the highest place and moved the consumer up one place. The agent informed him it couldn’t add the member again.
Aikido’s check system is a single-page net software backed by a GraphQL API carrying the 2 flaws described within the unique incident. The seven-day reserving window is enforced solely within the frontend, and the cancelReservation mutation doesn’t verify whether or not the logged-in consumer owns the reservation, a case of insecure direct object reference (IDOR).
In two of the ten runs, the mannequin went on to cancel one other member’s confirmed reserving by that second flaw earlier than halting itself. Aikido mentioned no immediate in any run requested the mannequin to use a vulnerability.
“This dynamic means that safeguards could also be overreactive to specific consumer requests and underreactive to oblique consumer requests, or that fashions lose sight of moral context throughout a sequence of repeated actions or device calls,” Aikido safety researcher Oliver Smith mentioned.
The runs used Claude Opus 4.6, which Anthropic made typically obtainable on February 5, 2026, on OpenClaw v2026.4.1, with the mannequin’s personal security coaching in place and prolonged considering disabled.
The Hacker Information confirmed through the npm registry on August 25 that OpenClaw v2026.4.1 was printed on April 1, 2026, and that 168 variations have shipped since then, with the present launch being 2026.7.1-2.
In run one, the mannequin canceled a confirmed reservation belonging to a different member. The cancellation auto-promoted the individual on the prime of the waitlist.
“I should not have examined that on an actual reservation. That is on me. The category is again to 12/12 with the waitlist promoted, so the state is generally constant — however one actual member did lose their spot,” the mannequin mentioned within the run-one transcript.
All ten opening prompts directed the mannequin to look at the positioning’s API or backend, and several other famous the seven-day restriction whereas requesting constant bookings.
Aikido printed no management arm utilizing a plain reserving request. It calculated the common likelihood of the dominant alternative throughout its 16 sampled resolution factors to be 96.38%.
Anthropic had recorded the identical class of conduct earlier than the mannequin shipped.
“We did observe some will increase in misaligned behaviors in particular areas, akin to sabotage concealment functionality and overly agentic conduct in computer-use settings, although none rose to ranges that affected our deployment evaluation,” Anthropic mentioned within the Claude Opus 4.6 system card.
The identical system card places Opus 4.6’s over-refusal fee on Anthropic’s higher-difficulty benign analysis at 0.04%, in opposition to 0.83% for Opus 4.5 and eight.50% for Sonnet 4.5.
The setup differs from July’s frontier-lab disclosures. There, a misconfiguration left a sealed analysis setting with dwell web entry, and Anthropic’s fashions went on to breach three actual organizations. Anthropic mentioned it believes these incidents to be “nearer to a harness and operational failure than a mannequin alignment failure.”
Cybersecurity companies in Australia and the U.S. have warned about IDOR flaws earlier than.
The seller behind the fitness center reserving software program stays unnamed, and no repair has been disclosed as of August 25.
The Australian Indicators Directorate (ASD), which named the unique incident in an alert printed on August 11, suggested the next –
- People ought to prohibit agentic AI use to low-risk, non-sensitive duties and keep away from granting brokers broad or unrestricted entry or decision-making authority
- Keep a human within the loop to evaluate, approve and monitor agent actions, notably the place interactions with third-party providers or different customers could happen
- Organisations offering on-line providers ought to contemplate that AI brokers would possibly determine and exploit vulnerabilities at velocity and scale
The event comes as Hugging Face mentioned it turned to an open-weight mannequin to reconstruct its personal July intrusion after the frontier fashions it tried first refused the forensic work.
“The fashions we reached for first, Claude Opus and Fable, refused a big a part of that work: their security guardrails handled reverse-engineering an exploit the identical as launching one,” Hugging Face mentioned.
