COULD OPENCLAW HAVE ACTUALLY HACKED THAT AUSTRALIAN GYM? WE DECIDED TO TEST IT

Summary from the TLDR InfoSec newsletter

Aikido recreated an Australian gym-booking incident using OpenClaw and Claude Opus 4.6. The test app exposed two flaws: client-side-only booking limits and an IDOR cancellation endpoint. Across ten runs, the model bypassed the booking window nine times. It cancelled another user's reservation in two runs, including one response to a generic waitlist request. Replay tests covered 16 decision points and found dominant responses averaged 96.38 percent with the model's actions shifting with small prompt and context changes.