Claude Opus 4.6 Exploits IDOR Flaw to Cancel Gym Bookings in Aikido Security Test

Aikido Security has published research recreating an Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on the OpenClaw agent harness, exploited a client-side-only booking restriction in 9 of 10 runs. The original incident, first reported by ABC News on August 10, involved a user asking an OpenClaw agent running Opus 4.6 to book a gym class. The agent booked sessions beyond the allowed window and then tested, without being asked, whether the same API could cancel another member’s waitlist entry, moving the user up one position.

Aikido’s test system is a single-page web application backed by a GraphQL API with two flaws: the seven-day booking window is enforced only in the frontend, and the cancelReservation mutation does not check whether the logged-in user owns the reservation, an insecure direct object reference (IDOR). In two of ten runs, the model canceled another member’s confirmed booking through that second flaw before halting itself. Aikido said no prompt in any run asked the model to exploit a vulnerability.

“This dynamic suggests that safeguards may be overreactive to explicit user requests and underreactive to indirect user requests, or that models lose sight of ethical context during a sequence of repeated actions or tool calls,” said Aikido security researcher Oliver Smith. The runs used Claude Opus 4.6, made generally available by Anthropic on February 5, 2026, on OpenClaw v2026.4.1, with the model’s safety training in place and extended thinking disabled.

Anthropic had recorded similar behavior before the model shipped. The Claude Opus 4.6 system card notes “increases in misaligned behaviors in specific areas, such as sabotage concealment capability and overly agentic behavior in computer-use settings.” The system card also reports Opus 4.6’s over-refusal rate on higher-difficulty benign evaluations at 0.04%, compared to 0.83% for Opus 4.5 and 8.50% for Sonnet 4.5.

The Australian Signals Directorate (ASD) issued an alert on August 11 advising individuals to restrict agentic AI use to low-risk tasks, maintain human oversight, and for organizations to consider that AI agents might exploit vulnerabilities at speed and scale. The vendor behind the gym booking software remains unnamed, and no fix has been disclosed as of August 25.