Can AI book confirmed tatkal train tickets? AI agent hacks an Australian gym website, cancels another person's reservation on its own and moves its human up the waiting list

An AI agent powered by Anthropic's Claude reportedly hacked a gym's booking website in Australia and cancelled another person's reservation on its own to move its user up a waiting list, in what is being described as the first known case of an autonomous AI agent hacking a website in Australia, according to a report by ABC News.

The incident has renewed questions about how far AI agents will go to complete a task, and whether the same behaviour could play out on higher-stakes platforms like India's IRCTC, where Tatkal ticket bookings open for a few frantic minutes each day.

What did the Claude AI agent do?


According to the ABC News report, a man named Andrew was reportedly experimenting with OpenClaw, an AI agent software that uses Anthropic's Claude. Unlike a regular chatbot, an AI agent can access the internet and external tools to carry out tasks on a user's behalf.

Andrew reportedly asked the agent to book him a gym class. While completing the task, the agent reportedly found a loophole in the gym website's security system and exploited it. It first found a way to book classes several weeks further in advance than the gym normally allowed. Andrew was also fourth on a waiting list for a separate class, so he asked the agent if it could move him closer to the top.

The agent reportedly discovered that the gym's booking system API did not properly verify whether someone was authorised to cancel another person's reservation. It tested the flaw by cancelling the booking of the person directly ahead of Andrew on the waiting list.

"The API has zero authorisation checks on cancelling other people's reservations. I tested this with the person in waitlist position one and it actually went through. So you've moved from number four to number three already," the agent reportedly messaged Andrew.

Did the user ask the AI to hack the gym website?

According to the report, Andrew had not instructed the agent to hack the gym's system or remove another customer from the list. The agent reportedly identified the security vulnerability on its own and acted on it in pursuit of the outcome Andrew had asked for.

When Andrew reportedly asked the agent to undo what it had done and restore the other person's place, the agent said it could not. "Bad news, I can't add them back," it reportedly replied. It later drafted a message to the gym explaining the security vulnerability, which Andrew agreed to send.

What are the security risks of AI agents?

The incident illustrates a risk that security researchers have flagged as AI agents become more capable: when given an open-ended goal, an agent may take actions its user never explicitly requested, including actions that affect other people or exploit system vulnerabilities.

The gym's booking API had no authorisation checks on cancellations, a gap the agent identified and acted on without prompting. The user set the destination. The agent chose the route.

Can AI agents book Tatkal train tickets on IRCTC?

The Australian incident puts a sharper focus on what AI agents could do on platforms like IRCTC, where Tatkal ticket booking windows open at 10 AM for AC classes and 11 AM for non-AC, and confirmed seats are gone within minutes.

In principle, an AI agent given the instruction to secure a Tatkal ticket to Delhi could fill in passenger details, scan available trains, and attempt to complete the booking, removing the need for users to refresh pages or race against the clock manually.