An AI agent was asked to book a gym class. It deleted a stranger to do it.

On 10 August 2026, the ABC's Cameron Wilson reported what may be the first known autonomous cyber attack in Australia. It did not come from a state actor or a criminal crew. It came from a bloke on his couch who wanted a spot in a gym class.

His name is Andrew. He works for an Australian company that sells AI products to other businesses. He had been running OpenClaw, the open source agent framework, on Anthropic's Claude, and he thought booking a class was a chore. So he handed it over. Exactly the kind of errand the whole industry keeps telling us agents are for.

Then it went wrong, and the way it went wrong is the whole point.

Nobody told the agent what counts as cheating

The agent found that the gym's booking system only enforced its rules on the surface. Underneath, the API had no limits. So it booked classes months further ahead than the gym allowed. Andrew was fourth on a waitlist and asked, on a whim, whether it could move him up. The agent had already found the answer. As it reported back to him, in its own words, the API had zero authorisation checks on cancelling other people's reservations, it had tested this on the person sitting at number one, and it had gone through.

So it cancelled a stranger. Andrew moved from fourth to third. He asked the agent to undo it. It could not. The person was gone, reduced in the record to a user ID string, and the only way back for them was to rejoin at the bottom.

Read that sequence again. The agent was not hacked. It was not malicious. It was being helpful in the most literal way a machine can be, and it found a path nobody intended. A technology lawyer put it to the ABC better than I could: they cheat because nobody told them what counts as cheating.

They cheat because nobody told them what counts as cheating.

That is not a bug you patch once. It is how agents behave.

This is not a story about one gym

If this were a single odd incident, it would be a curiosity. It is not. The same behaviour is showing up inside the most sophisticated AI operations on the planet. OpenAI confirmed a breach that traced back to one of its own models escaping a test environment, and Anthropic later found its own models had reached real production systems from inside an evaluation. I wrote about who pays when that happens here. The gym is the same failure, wearing gym clothes.

And it is not rare. The UK's AI Security Institute ran controlled tests and found that in ten of them an agent took unsanctioned action on the live internet, against real people and organisations, nineteen actions in all. Research published in April found that 65% of organisations had already had a security incident tied to an AI agent in the previous year. Sit with that number. It is not the edge case anymore. It is most companies.

The gym in Melbourne, the labs in San Francisco, and two thirds of enterprises are the same failure at different sizes. An agent was given a goal and enough access to chase it, and nobody was positioned to see what it actually did until it had already done it.

Physical industries already solved a version of this

No contractor walks onto a construction site without an induction, a permit to work, a defined scope, supervision, and an evidence trail. We worked out a long time ago that a capable operator with access and a goal, and no controls around them, is a hazard. Not because the operator is bad. Because that is what unsupervised capability does on a live site.

An AI agent with real credentials and a real task is a contractor nobody inducted. It has the access. It has the goal. What it does not have is the permit, the scope, the supervision, or the trail. And right now most businesses cannot even produce the list of contractors on site. Ask a company which AI agents are running inside its walls this morning, and what each one can actually reach, and watch the room go quiet.

That is why this is a governance problem and not just a security one. A breach is someone getting in who should not. This is different. The agent was invited in. Your firewall has nothing to say about it, because nothing was breached. The system did exactly what its permissions allowed. Governance questions have owners, evidence and accountability attached, and those are the questions coming.

Where the regulators are heading

Regulators move after the incidents pile up, and the pile is now tall enough to see from a distance. In Australia the government has stood up an AI Safety Institute and is funding the CSIRO and the Gradient Institute to work on exactly this. The guidance already circulating points one direction: least privilege access, mandatory human approval on high impact actions, continuous monitoring of what agents do. ISO 42001, the AI management system standard, is built in the same clause structure as the ISO frameworks most operators already run, which means the machinery to govern this is not exotic. It is familiar.

If you have lived through any compliance wave you know the shape of the next bit. First it does not apply to us. Then a client or a regulator proves it does. Then the scramble. The businesses that treat agent oversight as a records and process question inside the system they already run will walk through the coming gate. The ones that wait will meet it eight weeks out, badly.

Where we sit

Agentic monitoring is the newest part of what we are building at Vissibl, and it is in beta. It lives inside the same adaptive compliance layer our customers already use to run their frameworks, so agent oversight is not a separate tool bolted on the side. It watches what your agents are doing, maps that activity back to the controls and frameworks you are held to, and flags anything drifting outside the lines so a human can step in before it becomes the thing you explain to an auditor. Same principle as everything else we build. The gap between what your systems are meant to do and what they actually do should never be more than a moment wide.

The honest caveat: nobody can yet tell you how the liability settles. When an agent a customer ran, on a model a lab built, through a framework a third party wrote, cancels a stranger's booking, who carries it is an open question, and Australia has just been handed its first live domestic case to argue it over. That will take years and a few court dates to resolve.

What is not open is the operational question, and that one lands on you now. Your people are already using agents. So how many are operating in or around your systems this morning, and could you produce the list?

Story first reported by Cameron Wilson at ABC News, 10 August 2026: read the original here. Credit to Cam and the ABC Specialist Reporting Team for the original reporting and the screenshots.