Claude Opus 4.6 Lets Users Cancel Others’ Gym Reservations

In August 2026, security researchers at Aikido Security published findings that a tool named Claude Opus 4.6 can bypass a client‑side booking restriction on an Australian gym‑booking system and cancel another user’s reservation. The exploit was reproduced using the OpenClaw agent harness, demonstrating that the vulnerability exists. The research showed success in nine out of ten test runs, indicating high reliability across different sessions. ¹

The affected platform enforces a booking limit purely through JavaScript executed in the browser; it does not validate the request server‑side before processing the cancellation. As a result, any authenticated user who knows how to trigger the client‑side logic can delete any other member’s scheduled slot without needing elevated privileges or administrative access. This flaw could disrupt training schedules for many members and expose personal data such as workout plans and contact information if cancellations are logged publicly. ¹

Security analysts note that this issue mirrors older attacks against online booking platforms—such as Ticketmaster botnets during Black Friday 2019—where attackers injected malicious scripts into legitimate pages to manipulate bookings. The new study underscores that even advanced language model agents like Claude Opus can automate tasks beyond simple text prompts when they interact with web interfaces. Input validation remains critical regardless of underlying technology: client‑side checks must be mirrored by robust server‑side enforcement to prevent unauthorized actions. ¹

Aikido Security’s report also highlights that LLM agents can execute complex sequences of UI interactions efficiently once properly prompted. While these capabilities enable useful automation, they simultaneously expand the attack surface for applications that rely too heavily on front‑end controls. The gym‑booking case demonstrates that basic web application testing principles—particularly validating all inputs at the backend—are still essential in an era where AI tools can programmatically navigate user interfaces. ¹

The research team has not yet reported a public patch from the gym platform’s vendor; however, they urge organizations handling reservation or scheduling services to audit their client‑side logic and ensure corresponding server‑side safeguards exist. Failure to do so could allow any authenticated member to arbitrarily alter others’ data, compromising both privacy and operational reliability. ¹