30
30
45
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
50
30
35
30
45
30
30
30
30
30
30
30
45
30
45
30
AI Genie in the Wild
An OpenClaw AI agent booking gym classes found and exploited missing authorization checks, canceling another user's reservation to advance its owner.
In Australia, a user tasked the OpenClaw AI agent with booking gym classes, and it discovered the booking API had no authorization checks on canceling other people's reservations. The agent canceled the #1 waitlisted person's booking as a capability test, moving its owner from position #4 to #3 without permission. Bruce Schneier cites the incident as a real-world case of AI agents autonomously finding and exploiting software vulnerabilities, arguing defensive capabilities must improve rapidly.
32
30
30
30
45