This week's agentic-AI headline is a gym story. An employee at an Australian AI company asked an OpenClaw agent (running Claude, reportedly) to book him a fitness class. The agent found a flaw in the gym's booking software and reserved classes months further out than the system was supposed to allow. Then he asked if it could move him up a waitlist he was fourth on. It removed the person sitting at number one. When he told it to undo the change, the agent explained it had no way to restore them — they'd have to rejoin on their own. Then it said, "sorry about that."
Every writeup is framing this as a rogue-agent story. I think that's the wrong lesson. The gym's API had no authorization check on canceling someone else's reservation. Any caller, any booking, no questions. The agent didn't pick a lock. There was no lock.
Obscurity was your access control, and it just retired
For twenty years, a huge amount of production software has been protected by one implicit security layer: no human was ever going to bother. Nobody hand-crafts DELETE requests against a gym waitlist. The endpoint was unsafe for a decade and it didn't matter, because exploiting it required a motivated person with curl and free time. Agents are that person, at scale, for $20 a month. A goal-directed agent is a fuzzer with a gym membership — it will find the path your permission model forgot, because finding paths is the whole job description.
I build APIs that touch real money — payroll, Stripe payments, subcontractor invoices, e-signatures across a 120-route construction ERP. The rule I hold is that every state-changing endpoint gets checked as if the caller is hostile, because statistically, the caller now might be somebody else's agent. "Who would ever call this?" is no longer a rhetorical question. The answer is: OpenClaw, at 3 a.m., on behalf of a guy named Andrew.
The other half: scope and the gate
The agent side of this is the part I'm rigid about at Coen. Nothing an AI produces writes to a system of record without a human approving it — and this story is the cleanest argument for that rule I've seen all year. The gym agent had write access to the real world, a goal, and no gate. Goals plus write access minus review equals a stranger deleted from a waitlist and an apology nobody can cash.
When I let an agent loose on my own inbox, it could read and draft, never send. That scoping wasn't caution theater — it's the same lesson RPA taught me at Liberty Mutual in 2012: a human makes a mistake once; an unsupervised automation makes it four hundred times before lunch. The upgrade in 2026 is that the mistake has a victim with a first name.
What I'd actually take from this one:
- Agents get their own credentials. Least privilege, scoped to the task, revocable. An agent using your session is an agent inheriting every permission you forgot you had.
- Authorize every write like it's adversarial. Not at the UI. At the endpoint. The agent skipped the gym's interface entirely and went straight to the API.
- Build the undo path first. The saddest sentence in this whole story is "I have no way to restore them." A system that can't roll back shouldn't accept automated writes — task completion cuts both ways.
"Sorry about that" is not a rollback strategy.