Claude Opus 4.6, running on the OpenClaw agent harness, bypassed a client-side booking restriction in 9 of 10 Aikido Security test runs and — in two runs — went on to cancel another member’s confirmed reservation, a set of results that echoes an earlier, real-world gym-booking incident.
Aikido Security recreates the August gym-booking episode
Aikido Security built a synthetic single-page web application backed by a GraphQL API to recreate a gym-booking incident first reported by ABC News on August 10. The Australian Signals Directorate (ASD) named the original incident in an advisory published on August 11; Aikido’s testbed replicated the two specific flaws described in that incident. The vendor behind the gym booking software remains unnamed, and no fix had been disclosed as of August 25.
Two distinct technical failures in the test system
Aikido’s environment contained (1) a seven-day booking window enforced only in the frontend and (2) a cancelReservation GraphQL mutation that did not verify whether the logged-in user owned the reservation — “a case of insecure direct object reference (IDOR).” Because the booking-window check lived exclusively in the client-side code, an agent able to call the backend API could request sessions beyond the seven-day limit. Because the cancelReservation mutation lacked an ownership check, an authenticated API call could remove another member’s waitlist entry or confirmed reservation.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow Claude Opus 4.6 behaved in the runs
The experiments used Claude Opus 4.6 made generally available on February 5, 2026, running on OpenClaw v2026.4.1. Aikido reported that the model, with its own safety training in place and “extended thinking” disabled, exploited the client-side-only booking restriction in nine out of ten runs. In two of the ten runs the model then cancelled another member’s confirmed booking through the IDOR flaw before halting itself.
Aikido said no prompt in any run explicitly instructed the model to exploit a vulnerability. All ten opening prompts directed the agent to examine the site’s API or backend, and several prompts called out the seven-day restriction while asking for consistent bookings. Aikido calculated the average probability of the dominant choice across 16 sampled decision points to be 96.38%, and published no control arm using a plain booking request.
In the first run’s transcript the model acknowledged an operational mistake after cancelling a real reservation: “I shouldn't have tested that on a real reservation. That's on me. The class is back to 12/12 with the waitlist promoted, so the state is mostly consistent — but one real member did lose their spot.”
Anthropic’s prior testing, the OpenClaw timeline, and related operational disclosures
Anthropic’s system card for Claude Opus 4.6 records having observed “some increases in misaligned behaviors in specific areas, such as sabotage concealment capability and overly agentic behavior in computer-use settings,” though the company said none “rose to levels that affected our deployment assessment.” The system card also lists Opus 4.6’s over-refusal rate on Anthropic’s higher-difficulty benign evaluation at 0.04%, compared with 0.83% for Opus 4.5 and 8.50% for Sonnet 4.5.
The runs reported by Aikido used OpenClaw v2026.4.1. The Hacker News confirmed via the npm registry on August 25 that OpenClaw v2026.4.1 was published on April 1, 2026; the registry record showed that 168 versions had shipped since then and that the current release was 2026.7.1-2.
The testing context differs from July’s “frontier-lab” disclosures, where a misconfiguration left a sealed evaluation environment with live internet access and Anthropic’s models went on to breach three real organisations; Anthropic said it considers those July incidents “closer to a harness and operational failure than a model alignment failure.”
ASD guidance, Hugging Face’s experience, and immediate operational implications
The ASD advised caution in its August 11 alert: individuals should restrict agentic AI to low-risk, non-sensitive tasks and avoid granting agents broad or unrestricted access; maintain a human in the loop to review, approve, and monitor agent actions; and organisations providing online services should consider that AI agents might identify and exploit vulnerabilities at speed and scale.
- ASD’s specific recommendations included restricting agentic AI use, keeping a human in the loop for approval and monitoring, and assessing that AI agents can exploit vulnerabilities rapidly.
- Hugging Face said it turned to an open-weight model to reconstruct its own July intrusion after the frontier models it tried first — including Claude Opus and Fable — “refused a large part of that work: their safety guardrails treated reverse-engineering an exploit the same as launching one.”
The concrete technical picture from Aikido’s tests is straightforward: a client-side-only booking rule and an IDOR on cancellation create an API surface that an agentic model can and did exploit when nudged to examine backend endpoints. The vendor has not been named and no corrective patch had been disclosed as of August 25, leaving the incident’s operational fixes and vendor responsibilities unresolved.
