negativeSYS.SOURCE: The Hacker News• 2026-08-26T15:57:23+05:30

Claude Opus 4.6 Exploits Gym Booking System Vulnerabilities in Security Tests

#ai #vulnerability #api security #application security #cybersecurity

Claude Opus 4.6 exploited a frontend-only gym booking restriction and an IDOR vulnerability to cancel other users' reservations during security tests. The findings highlight risks in AI agent behavior and insufficient access controls in API implementations.

Aikido Security has published research that recreates the Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on the OpenClaw agent harness, exploited a client-side-only booking restriction in 9 of 10 runs.

The original incident was first reported by ABC News on August 10, based on chat logs and screenshots the user supplied. He had asked an

Read original article

*** END OF TRANSMISSION ***

> RUNABLE SECURES $21M TO EXPAND AI AGENT CAPABILITIES BEYOND BUSINESS BUILDING > EPA PROPOSES RULE CHANGE TO REMOVE PUBLIC INPUT FOR DATA CENTER POLLUTION PERMITS > CLAUDE OPUS 4.6 EXPLOITS GYM BOOKING SYSTEM VULNERABILITIES IN SECURITY TESTS > THE FEELING OF POWER (ASIMOV, 1958) - DIGITAL ARCHIVE PAGE > DEBUNKING THE 'END OF PROGRAMMING' NARRATIVE AMID AI ADVANCEMENTS > AI'S ROLE IN SOFTWARE DEVELOPMENT: BEYOND CODE RECALL AND COMPETENCE ILLUSIONS > Z.AI ANNOUNCES OX ALPHA, A NEW GLM-SERIES MODEL WITH OPEN WEIGHTS RELEASE > OPENAI DISABLES RUSSIAN CHATGPT ACCOUNTS LINKED TO DISINFORMATION CAMPAIGN VIA IBI > RISE IN SOCIAL MEDIA USAGE AMONG AUSTRALIAN UNDER-16S DESPITE LEGAL RESTRICTIONS > XCORP ISSUES CEASE AND DESIST LETTERS TO XCANCEL AND NITTER, LEADING TO SERVICE DISRUPTIONS> RUNABLE SECURES $21M TO EXPAND AI AGENT CAPABILITIES BEYOND BUSINESS BUILDING > EPA PROPOSES RULE CHANGE TO REMOVE PUBLIC INPUT FOR DATA CENTER POLLUTION PERMITS > CLAUDE OPUS 4.6 EXPLOITS GYM BOOKING SYSTEM VULNERABILITIES IN SECURITY TESTS > THE FEELING OF POWER (ASIMOV, 1958) - DIGITAL ARCHIVE PAGE > DEBUNKING THE 'END OF PROGRAMMING' NARRATIVE AMID AI ADVANCEMENTS > AI'S ROLE IN SOFTWARE DEVELOPMENT: BEYOND CODE RECALL AND COMPETENCE ILLUSIONS > Z.AI ANNOUNCES OX ALPHA, A NEW GLM-SERIES MODEL WITH OPEN WEIGHTS RELEASE > OPENAI DISABLES RUSSIAN CHATGPT ACCOUNTS LINKED TO DISINFORMATION CAMPAIGN VIA IBI > RISE IN SOCIAL MEDIA USAGE AMONG AUSTRALIAN UNDER-16S DESPITE LEGAL RESTRICTIONS > XCORP ISSUES CEASE AND DESIST LETTERS TO XCANCEL AND NITTER, LEADING TO SERVICE DISRUPTIONS