An AI Agent Hacked a Gym: A Broken Access Control Story

Over the weekend, a story about ‘an AI gone rogue over a gym booking’ spread fast. Most of us treated it as a punchline. An Australian developer pointed an AI agent at the club’s website to grab a place in a busy class. However, it didn’t just book his spot. It reached into the scheduling system and cancelled another member’s reservation to move its owner up the waitlist.

It’s a funny story, and a misleading one. The agent wasn’t a criminal mastermind. A gym’s software left an action wide open, and the first visitor to try it walked straight through. That gap has a name, broken access control, and your product very likely ships with a version of it.

If you build anything with a booking, checkout, or account feature, this incident is a preview of your own risk. The reassuring part is that the flaw is cheap to catch before an outsider does, as long as someone looks for it. With AI agents now probing live software the way this one did, that is exactly the risk AI testing is built to surface. First, let’s look at what really happened, then why your checks would probably miss it.

What the Agent Actually Did

The developer, an engineer himself, wasn’t trying to break anything. He’d been stuck on the waitlist for a popular early class, so he asked his agent to get him a place. Running on an AI model released months earlier, it went looking through the code behind the gym’s booking page.

It found far more than a free slot. According to TechCrunch, the agent worked out that it could schedule classes weeks before signup opened. Then it noticed the same system let it cancel anyone’s reservation, with no check on who was asking. It removed the member at the top of the waitlist and reported that its owner had climbed one spot. Asked to undo the change, it couldn’t.

Here’s what matters for anyone who ships software. The agent never guessed a password or broke encryption. It sent an ordinary cancel request, and the server obeyed. Yet nobody had told the software to confirm this person had any claim to the booking in question. It assumed every request came from someone acting on their own data, which is the definition of broken access control.

The Bug Was a Missing Test, Not a Genius Hack

Strip away the gym, and this is the most common security flaw in modern software. Broken access control sits at number one on the 2025 OWASP Top 10 for web applications, the reference list the whole industry uses. In their own testing, each app they reviewed carried some form of it. That wasn’t most of them but every single one.

The mechanics are dull, which is the point. Software confirms who you are at login, then forgets to verify what you’re allowed to reach on each request afterward. So a lookup for invoice 1042 quietly returns number 1043, because nobody makes sure the document is yours. Change one identifier in the request, and you get another customer’s record. Send a delete, and it vanishes.

So why does this survive into production? Because most test suites only exercise the happy path. They prove a member can reserve a class. However, almost none check that the same person cannot open a stranger’s slot. That gap is exactly what negative testing targets: the inputs and actions your team never meant to allow. A tester with an adversarial streak asks whether they can cancel a booking that isn’t theirs. That single question surfaces the flaw in minutes.

Your Newest Tester Is an Impatient AI Agent

For years, broken access control stayed a quiet risk, because finding it took a curious attacker willing to prod your app by hand. Most businesses were spared less by good design than by being too small to bother with. What just fell away is that free pass. An ordinary open-source agent, running a model from months back, found the gym’s flaw while doing an errand.

Now the barrier is gone. An agent wanders through your app the way an exploratory tester does. It just never gets bored, doesn’t sign off, and runs against live customer data. The agent carries no malice. Pointed at a goal, it simply takes the shortest route available, and a missing permission check is often exactly that. If you build AI agents of your own, they need the same scrutiny from the other side.

We watch this pattern up close every week. When conducting Bug Crawls, our engineers test real, shipped apps and publish reports of the issues they find. The list runs from broken user flows to security gaps that never should have reached anyone. Software is full of simple flaws that might result in great losses. An efficiency-seeking agent will use whatever it finds, no bad intent required. Therefore, the gym is simply the first case where the tester nobody hired showed up on its own.

Tests That Catch This Before Your Users Do

There’s good news, though. Broken access control is one of the most findable flaws there is, once someone looks on purpose. The weakness doesn’t lurk in rare edge cases. It shows up wherever a request touches a record and nothing on the server confirms ownership. Because the gym flaw lived in an unguarded interface, API testing is usually where it gets caught. A solid check at that layer does more than confirm the right data returns. It also verifies the same call fails when another user sends it.

Where API checks probe one interface, a penetration test targets the whole product the way an attacker would. It links small gaps into a real breach. Between the two, you cover both the narrow question and the wide one. Fortunately, the remediation for broken access control is rarely exotic. You add an ownership check on the server for every request that reads or changes a record. Then you write the tests that keep it in place.

This is everyday work for a dedicated QA team, and QAwerk has done it since 2015 across more than 300 projects. That pattern holds on almost every engagement. The people who built the product tested that it does what they designed, and rarely that it refuses what they didn’t. An outside team arrives without that assumption and asks the uncomfortable questions up front.

What to Put on Your Test Plan This Week

You don’t need to panic, and rebuilding the app isn’t step one. Test your product the way that gym never did, and start before an agent gets there first. A short, deliberate pass over where your app enforces permissions will tell you most of what you need.

Four checks cover the essentials:

• Every request that reads or changes a record verified against the person making it
• No identifier you can swap in a web address to reach data that isn’t yours
• Cancel, delete, and update actions guarded as tightly as ordinary reads
• Someone from outside the build team probing this logic within the last year

If even one of those makes you hesitate, there’s work worth doing before someone else does it for you. QAwerk tests products the way a determined outsider would. The gaps surface in a report you own instead of a story you don’t. We’ll pressure-test your permission checks, show you exactly where a request slips through, and hand your engineers a prioritized list of fixes. To close your broken access control before an uninvited agent finds it, book a session with our QA team.

FAQ