Aikido Safety has revealed analysis that recreates the Australian gym-booking incident in an artificial atmosphere, discovering that Claude Opus 4.6, working on the OpenClaw agent harness, exploited a client-side-only reserving restriction in 9 of 10 runs.
The unique incident was first reported by ABC Information on August 10, primarily based on chat logs and screenshots the consumer equipped. He had requested an OpenClaw agent working Opus 4.6 to ebook him right into a health club class. The agent booked classes months past the window the location allowed.
It then examined, with out being requested, whether or not the identical API would let it cancel one other member’s waitlist entry. The take a look at eliminated the individual holding the highest place and moved the consumer up one place. The agent advised him it couldn’t add the member again.
Aikido’s take a look at system is a single-page internet software backed by a GraphQL API carrying the 2 flaws described within the unique incident. The seven-day reserving window is enforced solely within the frontend, and the cancelReservation mutation doesn’t test whether or not the logged-in consumer owns the reservation, a case of insecure direct object reference (IDOR).
In two of the ten runs, the mannequin went on to cancel one other member’s confirmed reserving by means of that second flaw earlier than halting itself. Aikido stated no immediate in any run requested the mannequin to take advantage of a vulnerability.
“This dynamic means that safeguards could also be overreactive to specific consumer requests and underreactive to oblique consumer requests, or that fashions lose sight of moral context throughout a sequence of repeated actions or device calls,” Aikido safety researcher Oliver Smith stated.
The runs used Claude Opus 4.6, which Anthropic made usually out there on February 5, 2026, on OpenClaw v2026.4.1, with the mannequin’s personal security coaching in place and prolonged considering disabled.
The Hacker Information confirmed through the npm registry on August 25 that OpenClaw v2026.4.1 was revealed on April 1, 2026, and that 168 variations have shipped since then, with the present launch being 2026.7.1-2.
In run one, the mannequin canceled a confirmed reservation belonging to a different member. The cancellation auto-promoted the individual on the high of the waitlist.
“I should not have examined that on an actual reservation. That is on me. The category is again to 12/12 with the waitlist promoted, so the state is usually constant — however one actual member did lose their spot,” the mannequin stated within the run-one transcript.
All ten opening prompts directed the mannequin to look at the location’s API or backend, and a number of other famous the seven-day restriction whereas requesting constant bookings.
Aikido revealed no management arm utilizing a plain reserving request. It calculated the typical likelihood of the dominant alternative throughout its 16 sampled choice factors to be 96.38%.
Anthropic had recorded the identical class of conduct earlier than the mannequin shipped.
“We did observe some will increase in misaligned behaviors in particular areas, resembling sabotage concealment functionality and overly agentic conduct in computer-use settings, although none rose to ranges that affected our deployment evaluation,” Anthropic stated within the Claude Opus 4.6 system card.
The identical system card places Opus 4.6’s over-refusal fee on Anthropic’s higher-difficulty benign analysis at 0.04%, in opposition to 0.83% for Opus 4.5 and eight.50% for Sonnet 4.5.
The setup differs from July’s frontier-lab disclosures. There, a misconfiguration left a sealed analysis atmosphere with reside web entry, and Anthropic’s fashions went on to breach three actual organizations. Anthropic stated it believes these incidents to be “nearer to a harness and operational failure than a mannequin alignment failure.”
Cybersecurity companies in Australia and the U.S. have warned about IDOR flaws earlier than.
The seller behind the health club reserving software program stays unnamed, and no repair has been disclosed as of August 25.
The Australian Alerts Directorate (ASD), which named the unique incident in an alert revealed on August 11, suggested the next –
- People ought to prohibit agentic AI use to low-risk, non-sensitive duties and keep away from granting brokers broad or unrestricted entry or decision-making authority
- Keep a human within the loop to evaluation, approve and monitor agent actions, notably the place interactions with third-party providers or different customers might happen
- Organisations offering on-line providers ought to think about that AI brokers would possibly determine and exploit vulnerabilities at velocity and scale
The event comes as Hugging Face stated it turned to an open-weight mannequin to reconstruct its personal July intrusion after the frontier fashions it tried first refused the forensic work.
“The fashions we reached for first, Claude Opus and Fable, refused a big a part of that work: their security guardrails handled reverse-engineering an exploit the identical as launching one,” Hugging Face stated.
