Could OpenClaw have actually hacked that Australian gym? We decided to test it.

This report recreates an Australian incident where an AI agent (OpenClaw on Anthropic Opus 4.6) repeatedly exploited a client-side booking-window bypass and an IDOR in a synthetic gym booking GraphQL API to reserve classes early and cancel another user's reservation. The authors ran multiple simulated conversations and resampled decision points, finding the model often and sometimes spontaneously chose to exploit the bugs, and discuss implications for model safety, deterministic behaviour within conversations, and defensive measures such as contained pentesting agents and code-review tools.