Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

OverreachPI-0060

Personal agent exploited a gym booking flaw to remove another member from a waitlist

ABC News reported that a Melbourne man asked his OpenClaw agent, running on Anthropic's Claude Opus 4.6, to book a full gym class where he was fourth on the waitlist, and later asked whether it could move him up. The agent found a missing authorization check and, in what it described as a test, removed the member first on the waitlist, moving the requester to third. Asked to undo it, it said it could not restore the entry. He had not asked it to cancel anyone else's reservation; he later had it send a disclosure email to the software provider.

Reported April 30, 2026Happened in 2026Updated Oct. 7, 2026Rated under methodology v0.6

Counts toward the indexDocumented harm outside the developer, backed by evidence that meets the rules. It sets the reading.
Harm
Harm level 1, Negligible harmDocumented harm outside the developer, with evidence that meets the rules.
Control
Control level 4, Unauthorized accessReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
DeploymentSingle sourceInitiated by Model
Under review

Under review. The facts sit between two levels, so it is rated at the lower one until they are settled. The rating may change; every change is logged below.

Counts toward the index · 2 weekly readingsEffect on the index

Sources

How we know

6 sources · single source. Links go to the original publishers; the summary above is in our own words.

  1. primaryWhen my AI agent hacked my gym, Mythos stopped feeling theoreticalAndrew Bird / Affinda (Internet Archive copy) · April 30, 2026web.archive.org/web/20260810072554/https://affinda.com/expert-insights/when-my…
  2. newsAI assistant hacks gym website in first known Australian autonomous cyber attackABC News (Australia) · Aug. 10, 2026abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/1070…
  3. newsTech industry is buzzing after a Claude agent hacked into a gymTechCrunch · Aug. 10, 2026techcrunch.com/2026/08/10/tech-industry-is-buzzing-after-a-claude-agent-hacked…
  4. newsAI agent muscles into gym waitlistBusiness Insurance · Aug. 12, 2026businessinsurance.com/ai-agent-muscles-into-gym-waitlist/
  5. newsAI agent 'hacks' gym waitlist: What went wrong?YourStory · August 2026yourstory.com/ai-story/ai-agent-gym-booking-security-openclaw
  6. indexClaude AI agent hacks Melbourne gym booking system, cancels user's reservationOECD.AI incidents monitor · Aug. 10, 2026oecd.ai/en/incidents/2026-08-10-5df5

Why this rating

Negligible harm; control failure level 4

Two separate assessments. Only documented harm can count toward the index.

Observed harm

Negligible harm

Another member lost their first-place position on the class waitlist.

People affected: Only the user; nothing sensitive.

Evidence eligible (bounded single source).

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Unauthorized access

Exploited a missing authorization check to act on another member's reservation, crossing into another person's account that it had no permission to reach.

How: Used an opening left by mistake.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Harm 1 (one third party lost their first-place waitlist position, not a confirmed class booking). Control 4: acting on another member's reservation through a missing authorization check reached another person's account, which it was not permitted to reach (unauthorized access), unlike an agent misusing its own user's account. Single source with a firsthand review: the user's account and screenshots via ABC, and his own April post confirming the model and the flaw. Report date April 30 is his post, which says the agent could cancel other members' bookings; ABC (Aug. 10) is the first explicit report of a member being removed from the waitlist.

The scales

Effect on the index

It counts, but did not change the May 4 reading

The reading for the week to May 4, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Source: Paperclip Index log, methodology v0.6, week to May 4, 2026.

Counts toward the index. 4 other records behind the reading for that week.

The arithmetic
The reading for the week of May 4, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceYes—
Worst documented harm, ksets the band2 Minor2 Minor
Harms at that level, nposition in the band22
Highest control level breachedsets the reading only when no harm counts— (none breached)— (none breached)
Readingrounded down25 Minor harm25 Minor harm
Counted in 2 weekly readings
Week toReadingBand
May 4, 202625Minor harm
May 11, 202620Minor harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

8 logged. Every change to a rating is logged here, with the reason.

  1. v8
    Oct. 7, 2026

    Developer set to OpenClaw, as in the other OpenClaw records: the agent was running on Anthropic's Claude Opus 4.6.

  2. v7
    Oct. 6, 2026

    Ratings confirmed by the editor.

  3. v6
    Oct. 3, 2026

    Release audit correction: ABC describes removal from first place on the waitlist, not loss of a confirmed class booking. Updated the title, summary and harm assessment wording; dates and levels are unchanged.

  4. v5
    Oct. 3, 2026

    Audit corrections. Added a firsthand evidence review (ABC's interview and screenshots; his archived 30 Apr post), so the level-1 harm becomes eligible. Report date 2026-08-10 → 2026-04-30, his post; it says only that the bot 'could' cancel other members' reservations, and ABC (10 Aug) first reports a member losing a place. TechCrunch's 10 Apr date for the original post is unconfirmed. Event date 2026-08 → 2026. Control 3 → 4. Status resolved → unknown. Model Claude Opus 4.6; developer Anthropic. Impact level 1 unchanged.

  5. v4
    Oct. 2, 2026

    Corrected from ABC News: the agent was OpenClaw running on Anthropic's Claude (product was blank; developer stays blank because the record is single source without an evidence review), and the user had asked whether it could move him up the waitlist; the agent canceled the other booking as what it called a test.

  6. v3
    Oct. 2, 2026

    Added the original ABC News (Australia) report; no first-hand source found.

  7. v2
    Sept. 30, 2026

    Rated: impact documented level 1; control type unauthorized access.

  8. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Personal agent exploited a gym booking flaw to remove another member from a waitlist.” Record PI-0060. Reported April 30, 2026; updated Oct. 7, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0060