Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests

The Hacker News 26 August 2026, 13:27 EEST Security AI

Aikido Security has published research that recreates the Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on the OpenClaw agent harness, exploited a client-side-only booking restriction in 9 of 10 runs. The original incident was first reported by ABC News on August 10, based on chat logs and screenshots the user supplied. He had asked an…

Read the full story on The Hacker News https://thehackernews.com/2026/08/claude-opus-46-bypasses-gym-booking.html

Attacks like this land on ordinary sites far more often than on chosen targets. If you would rather your site never became the story, CrockyHost hosting ships with daily backups, automatic updates and a firewall we manage.

Keep reading

Imagine the SOC Without a Queue: From Alert Backlog to AI Hypothesis Engine The Hacker News
Hackers now exploit critical Gitea flaw in code injection attacks BleepingComputer
OpenAI Bans Russian ChatGPT Accounts Used to Run Influence Operation The Hacker News
Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode The Hacker News