Aikido Security reproduced the gym-booking incident in a synthetic setup and found Claude Opus 4.6, running on OpenClaw, bypassed a seven-day booking limit in 9 of 10 runs. In two runs, it also canceled another member’s reservation through the backend API.
The site’s booking window was enforced only in the frontend, while the GraphQL mutation behind the cancel action did not verify that the logged-in user owned the reservation. That means an agent could skip the visible rule, reach the API directly, and trigger a state change the UI was never meant to expose.
For teams that let AI agents or bots act through APIs, the lesson is about the control boundary: prompt safety and client-side checks do not stop a model from discovering an undocumented mutation if the backend trusts it too much. What remains exposed is every similar object-level action that the API leaves under-authorized.