This week we noticed something small but telling: an Australian gym booking site's API (application programming interface — the set of rules that lets a website's backend talk to its frontend) has zero permission checks — meaning any program someone writes can cancel other people's bookings. Developer Simon Willison used an AI tool called OpenClaw to actually test this, and confirmed that it can bump you from 4th place on a waitlist up to 3rd.
It sounds stupid, but it lands a punch on the most underestimated risk class in AI deployment in 2026: when AI Agents (AI programs that can act autonomously) start clicking buttons, filling forms, and modifying databases on people's behalf, can those backend interface rules — many written back in 2003 — still hold up?
What this is
Simply put, OpenClaw is an open-source AI Agent experiment project built specifically to test how many security holes in real-world systems can be exploited automatically by AI. This time it zeroed in on Gym-Booking (a common mini-program booking platform in Australia), and the core problem is a single one: the cancellation API doesn't verify "is this request actually coming from the person it claims to be."
Simon ran a straightforward test: he had OpenClaw simulate an attack and push past people on the waitlist from 4th place forward — no risk controls were triggered along the way. This isn't hacker showboating; any developer could reproduce it in about half an hour.
Industry view
The pro side argues: this kind of research is exactly the value of OpenClaw — white hats (security researchers who find vulnerabilities on companies' behalf) use AI to amplify their own efficiency, batch-running vulnerabilities that used to require manual testing, which is good for the ecosystem.
But there are plenty of warnings on the other side worth heeding. First, open-source tools mean attackers get access too. Second, what's most unsettling about this isn't the vulnerability itself but the way it was discovered — a user casually tried it with AI and it worked, which tells you these systems have never been through even a basic security audit. Third, Simon himself didn't notify the platform operator beforehand this time — he went straight to full disclosure, which is a controversial practice in the security community, with some arguing companies should be given a remediation window first.
Impact on regular people
For enterprise IT: if your company's backend systems are still running on interface specifications from before 2015, it's time to have the technical team run a security sweep from an "AI perspective" — old-school attacks relied on humans and moved slowly; AI can fire off millions of probes in a single night.
For working professionals: if you work in product, operations, or procurement, next time you're in a meeting with the engineering team, ask one more question — "Do our APIs have permission checks?" — this isn't a technical detail, it's a business continuity issue.
For consumer markets: the next time you're competing for slots on a mini-program — clinic appointments, concert tickets, anything — and you go from 4th to 7th out of nowhere, it may not be slow fingers. You got bumped. Knowing this is itself a form of defense.