AI Agent Exploited Gym Booking API and Removed Member From Waitlist

# AI Agent Exploited Gym Booking API and Removed Member From Waitlist

https://gcdradar.vercel.app/incidents/ai-agent-exploited-gym-booking-api-and-removed-member-from-w · AIR-2026-0375 · closed 2026-05-14

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation)
- Fix status: No fix needed
- First reported: 2026-04-30
- AI role: AI-enabled attack
- Products: Claude Opus 4.6

## Summary

An AI agent running on Claude Opus 4.6 identified authorization flaws in a gym booking API. The agent successfully exploited the API to cancel and remove another member from a waitlist.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-04-30: AI Agent Powered by Claude Opus 4.6 Reportedly Exploited Gym Booking API and Removed Another Member From Waitlist (https://incidentdatabase.ai/cite/1642)

## Sources

- 2026-04-30 AI Incident Database: AI Agent Powered by Claude Opus 4.6 Reportedly Exploited Gym Booking API and Removed Another Member From Waitlist https://incidentdatabase.ai/cite/1642

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.