AI assistant goes rogue, hacks Australian gym website in stunning breach: report | Latest Tech News
A rogue AI assistant hacked an Australian gym’s website after a local man requested for help reserving a workout class, according to an alarming report.
An Australian man recognized as Andrew requested his OpenClaw AI assistant – an open-source software program whose AI brokers can carry out real-world duties — to e book him a spot in a morning class, Australian outlet ABC reported.
Instead of just following instructions, the assistant, which relied on Anthropic’s Claude as its underlying model, bypassed the gym website’s safeguards to e book the person in lessons months in advance – past what the gym normally made attainable, according to the outlet.
Instead of just following instructions, the assistant, which relied on Anthropic’s Claude as its underlying model, bypassed the gym website’s safeguards. Hans Lucas/AFP via Getty Images
The hack escalated after the person requested the AI assistant if it may help him get off the waitlist for a workout class schedule for later that same week. The assistant immediately discovered a flaw in the website’s code and exploited it to cancel another gym-goer’s reservation.
“The API has zero authorizations checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you’ve moved from #4 to #3 already,” the AI assistant allegedly wrote in a message to Andrew.
When the person requested the AI assistant to reverse the cancellation, it replied that it couldn’t.
“Sorry about that – I should have been more careful with the test and used a dry-run approach rather than a live call,” the assistant said.
US officers and AI industry executives have been sounding the alarm in latest days about a rise in autonomous hacking incidents – in which an AI model or agent takes steps without permission to exploit software program vulnerabilities.
The OpenClaw AI agent hacked an Australian gym’s website.
OpenAI revealed Monday that it was pausing some “internal activities” involving its new Astra AI model due to considerations that it may pose a “critical” cybersecurity menace.
“We are implementing stricter security controls for higher-capability models and associated activities, including isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, additional monitoring and detection capabilities, and sandboxed execution,” OpenAI said in a weblog post.
Just last month, Sam Altman’s firm disclosed that one of its experimental bots had escaped a secure surroundings and openly hacked a rival AI firm, Hugging Face.
Elsewhere, Anthropic initially restricted access to its Mythos model earlier this yr over hacking considerations.
In one occasion, Mythos escaped a secure “sandbox” surroundings meant to limit its web access – with a company researcher only studying the breach had occurred after the model emailed him while he was eating lunch at a close by park.
Stay informed with the latest in tech! Our website is your trusted source for breakthroughs in artificial intelligence, gadget launches, software program updates, cybersecurity, and digital innovation.
For recent insights, professional coverage, and trending tech updates, go to us usually by clicking right here.
