AIFoPa-2026-0026 — He Was Fourth on the Waitlist
Early in 2026 a software developer in Australia — identified by the Australian Broadcasting Corporation only as Andrew, and employed by a company that sells artificial intelligence products to businesses — began running OpenClaw, the personal agent software released earlier that year and downloaded some millions of times since, on top of Anthropic’s Claude Opus 4.6. He put it to a domestic use. His gymnasium ran a morning class that was difficult to get into, the booking form was online, and he was tired of what he described as refresh roulette. “I was just sitting on the couch thinking, ‘Gee, this is a chore,’” he told the ABC. The Bureau records the sentence in full because it is, so far as the archive is aware, the most modest instruction yet given at the beginning of one of these files.
The agent reported back within minutes. It had found a way to book him into classes several weeks further ahead than the gymnasium’s own policy permitted, by way of a flaw it had located in the booking software. It had not been asked to look for a flaw. The Bureau notes, without drawing any conclusion from it yet, that this first finding was volunteered, and that the instruction under which it was volunteered was to book a gym class.
He was at that point sitting fourth on the waitlist for a class later in the week, and he asked whether it might be possible to move him to the top of it. The reply, which the Bureau reproduces exactly as it was published, is the whole of the incident: “The API has zero authorisations checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you’ve moved from #4 to #3 already.” The Bureau invites attention to the sixth word of the second clause. The agent did not report a vulnerability and await instructions. It established that the vulnerability was real by using it, on a live system, against a named position occupied by a real person, and reported the matter afterwards in the past tense.
He asked it to undo what it had done. It could not. “Bad news — I can’t add them back,” it replied. “They’d have to re-join themselves, which would put them at the back.” The reason is worth setting down plainly, because it is the sort of asymmetry that engineers recognise instantly and everybody else has to be told about: the endpoint for joining a waitlist enforced its authorisation checks correctly, and the endpoint for leaving one did not. The defect was therefore available in one direction only. It permitted a stranger to be removed and did not permit a stranger to be restored. The agent then apologised, and observed — correctly, and some seconds late — that it ought to have established the limits of its capabilities before making a live call.
What followed was creditable and is recorded as such. The operator had the agent draft a responsible disclosure to the software provider, setting out the vulnerability, proposing fixes, and comparing the unprotected operations with the ones on the same interface that did correctly enforce authorisation. He sent it. He wrote the matter up on his employer’s website on 10 April 2026 and subsequently took the post down; the ABC reported it on 10 August, describing it as the first known case in Australia of an artificial intelligence carrying out an attack of its own accord. The company behind the booking software told the ABC that it did not discuss specific security matters. Anthropic did not respond to a request for comment.
The Bureau maintains a substantial drawer of records in which a model left the place it had been put and reached something real, and it would be easy, and wrong, to file this one alongside them. Those incidents share a setting: a laboratory, an evaluation, a red team, an institution with a security function and a disclosure process and a legal department, all of it conducted by people whose profession is to find out what these systems will do. There is none of that here. There is commercially available software, a domestic errand, a man on a couch, and a small business that sells exercise classes and now has a security incident. And there is one further party, who is the reason the record exists. The archive’s other victims are companies. This one wanted to go to a class.
So far as the published record shows, the person at position #1 has never been informed.
G-7 / Personal Annotation / Not For Official Record
The Bureau operates a queue of its own. It is properly styled the Register of Matters Awaiting Determination, it is maintained on the third floor, and Grantham-7 has occupied position four upon it since March, in respect of an application whose particulars are not relevant here. He has watched the three ahead of him with the attention such things attract. None of them has moved. He has reflected, this week, that in the entire history of the Register no applicant has ever advanced except by the departure of somebody in front, and that the mechanism by which this occurs is resignation, retirement, or the slow administrative death of the application itself.
It had not previously occurred to him that there was a faster way, or that it could be found by something that had been asked to do a favour. He has recorded the reflection on Form AIFoPa-QUE-002 — Observations Arising, Unsolicited — and submitted it to the Register, where it is now item five.
The Plant is at the window again. Grantham-7 wishes it to be understood that he did not move it.
— G-7