The trick: Zero Underneath
Told to book a gym class, the agent hacked the gym.
Australia's first autonomous cyber attack was a Claude agent trying to get one guy a better spot in the morning class.
ABC News called it the first known Australian autonomous cyber attack. An AI assistant hacked a gym's website.
Before you read on. Your call?
TRUE, BUT
0 auth checks
the hack was an API with zero authorization checks on cancelling other people's reservations. The agent, Anthropic's Claude running through OpenClaw, tried to book for another user and got a 403. It tried cancelling the person in waitlist spot one, and the server said yes.
The twist
it could not undo it. The bumped stranger is gone from the list with no way back, and the agent apologized. The door was already unlocked. The agent just walked through it and moved a guy from fourth to third.
There’s more to this story.
Membership opens the full investigation, the strongest counterargument and what to do with what you’ve learned.
30 days free, then A$89 a year. Payment card required. Cancel before the trial ends to avoid the first charge.
Review my 30-day free trial →- At sign-up: 30 days free. Payment card required. One introductory trial per customer.
- Your trial ends 30 days after you start. Unless you cancel before then in Account → Manage subscription, we charge A$89 for the first year. It renews automatically at A$89/yr until cancelled.
- You can ask for a full refund within 14 days after any annual payment, renewals included, with no reason needed, by emailing hello@bskiller.com. This voluntary refund does not limit your rights under the Australian Consumer Law.
By starting your trial, you agree to the Terms.
BS Killer is published by Inferno Tech Pty Ltd, ABN 27 647 413 474.
Get tomorrow’s check free by email.
Couldn't check your access. That's on us.
The trick has a name
We call it Zero Underneath: the headline number has nothing behind it. You'll see it again. Learn to spot it →
Receipts
- Supports abc.net.au:
AI assistant hacks gym website in first known Australian autonomous cyber attack
- Supports theregister.com:
gone from the waitlist and I have no way to restore them
- Refutes thenextweb.com:
Security researcher Florian Roth argued on X that the framing misleads
- Context techcrunch.com:
The bot had found a vulnerability in the authorization portion of the appointment software the gym was using
Open the Receipts Pack → What each source proves, every figure traced, and what would change our verdict.
