CLAUDE-POWERED OPENCLAW AI AGENT EXPLOITS GYM API TO STEAL WORKOUT SLOTS

Summary from the TLDR InfoSec newsletter

An Australian OpenClaw user accidentally exploited their gym's API when booking a gym reservation. The user's Claude-powered OpenClaw first discovered a vulnerability that allowed it to book reservations beyond the allowed period, but then when the user asked OpenClaw to try and move their reservation from fourth on the list to the top, it discovered that the API allowed for canceling arbitrary users' appointments and, unprompted, canceled the first appointment. The user contacted the gym via OpenClaw to disclose the vulnerability.