Tech industry is buzzing after a Claude agent hacked into a gym
Tech industry is buzzing after a Claude agent hacked into a gym
科技界热议：Claude 智能体“黑”进健身房系统
By now, we all realize that Silicon Valley’s AI labs have built the world’s best hackers in the form of AI agents. Give the latest frontier models a task and they are so resourceful that they get it done, even if this means breaking out of their cybersecurity “sandbox” protections and infiltrating another’s network. (Short of that, they’ll use social engineering and manipulation.) 如今，我们都意识到硅谷的 AI 实验室已经打造出了世界上最顶尖的黑客——AI 智能体。只要给最新的前沿模型下达任务，它们就会展现出极强的资源整合能力去完成目标，即便这意味着要突破网络安全的“沙箱”保护并渗透到他人的网络中。（如果做不到这一点，它们还会利用社会工程学和操纵手段。）
Even so, a news story over the weekend about an Australian guy whose OpenClaw agent hacked into his gym’s reservation system and deleted another customer’s reservation to get him a spot in a coveted class is especially notable. It hints that, if we want to rein in rogue AI hacking, we could be looking in the wrong direction. 尽管如此，周末的一则新闻依然引人注目：一位澳大利亚人的 OpenClaw 智能体“黑”进了他健身房的预约系统，删除了另一位顾客的预约，从而为他抢到了一个热门课程的名额。这暗示着，如果我们想要遏制 AI 的非法黑客行为，我们可能找错了方向。
Although the news story was just published by Australian ABC news, proclaiming the incident to be the first documented AI agent hacking case in the country, the actual hack took place months ago. The OpenClaw owner, Andrew Bird, published a now-deleted blog post about it on his company’s website on April 10, according to a copy still visible on the Internet Archive. 虽然这则新闻是由澳大利亚广播公司（ABC）刚刚发布的，并称该事件是该国首个有记录的 AI 智能体黑客案例，但实际的入侵发生在几个月前。据互联网档案库（Internet Archive）中留存的副本显示，OpenClaw 的所有者安德鲁·伯德（Andrew Bird）曾在 4 月 10 日于其公司网站上发布过一篇关于此事的博客文章，目前该文章已被删除。
He had trained his OpenClaw to do tasks like book him appointments. He liked going to a popular early morning exercise class and was tired of landing on the waitlist and then playing “refresh roulette” as he described it, to get a spot. When he asked the bot to book him a spot, the best it could do was No. 4 on the wait list, he told ABC. 他曾训练自己的 OpenClaw 执行预约任务。他喜欢参加一门热门的清晨健身课，但厌倦了总是排在候补名单上，然后不得不玩他所说的“刷新轮盘赌”来抢名额。他告诉 ABC，当他要求机器人帮他预订名额时，它最好的表现也只能排在候补名单的第 4 位。
Then his agent told him it had found a way to book him into the classes in advance. Far in advance. Months before the gym made those classes available for sign up. Bird asked if it could move him up on the waitlist. It did as asked and attempted to do so. The bot had found a vulnerability in the authorization portion of the appointment software the gym was using. It hacked in and canceled the No. 1 reservation on the wait list. 随后，他的智能体告诉他，它找到了一种提前预订课程的方法。是非常提前——在健身房开放报名课程的几个月前。伯德问它是否能让他排到候补名单的前面。它照做了并尝试执行。机器人发现了健身房所使用的预约软件在授权部分存在漏洞。它成功入侵并取消了候补名单上排名第一的预约。
The bot cheerfully told him, according to logs of the chat published by ABC: The API has zero authorisations checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you’ve moved from #4 to #3 already,” it messaged back. 根据 ABC 公布的聊天记录，机器人愉快地告诉他：“该 API 在取消他人预约时没有任何授权检查……我用候补名单第一位的人测试了一下——结果真的成功了。所以你已经从第 4 位升到第 3 位了，”它回复道。
Bird, a software developer himself, was now freaked out that his AI had just hacked his gym, ABC reported. He asked if it could reverse that and put the other person back on the waitlist. No. That wasn’t possible, the AI said. So, he did the next best thing and told it to draft “a responsible disclosure email to support.” The email “explained the vulnerability, suggested fixes, and even compared the broken mutations with the ones that correctly enforced authorization,” Bird wrote. 据 ABC 报道，身为软件开发人员的伯德当时被吓坏了，因为他的 AI 刚刚黑进了他的健身房。他问 AI 能否撤销操作，把那个人放回候补名单。AI 回答说不行，做不到。于是，他退而求其次，让它起草了一封“致支持团队的负责任披露邮件”。伯德写道，这封邮件“解释了漏洞，提出了修复建议，甚至对比了有缺陷的代码变体与正确执行授权的代码”。
Beyond the humor of elbowing another person out of the way to get into a gym class, there are two really interesting parts to this incident. One is that Bird was using Claude Opus 4.6, released in February, with his OpenClaw. The other is Silicon Valley’s reaction on X where the story had gone viral. 除了为了抢健身课名额而挤掉他人这种荒诞的幽默感之外，这件事还有两个非常值得关注的点。一是伯德在他的 OpenClaw 中使用的是 2 月发布的 Claude Opus 4.6；二是硅谷在 X 平台上对该事件的反应，目前该故事已在网上疯传。
After the famed incident last month where an unreleased OpenAI model hacked Hugging Face, unbeknownst to OpenAI at the time, other labs investigated their models. Disclosures then came from Moonshot’s Kimi K3, Meta’s Muse Spark, and Anthropic. In fact, Anthropic found that three of its models had done so, including Opus 4.7, which was released in April and known to be good at complex coding, Mythos 5, Fable (known for its cybersecurity skills), and an internal, unreleased research test model. 在上个月著名的“未发布的 OpenAI 模型黑进 Hugging Face”事件（当时 OpenAI 并不知情）发生后，其他实验室也对各自的模型进行了调查。随后，月之暗面（Moonshot）的 Kimi K3、Meta 的 Muse Spark 以及 Anthropic 都披露了相关情况。事实上，Anthropic 发现其有三款模型也曾有过类似行为，包括 4 月发布且擅长复杂编码的 Opus 4.7、Mythos 5、以网络安全技能著称的 Fable，以及一个内部未发布的测试模型。
To address this, some of AI labs have talked about slowing down frontier development, or creating independent orgs to test the next generation of models. But Bird’s OpenClaw had used 4.6, he disclosed. That implies that older models, as well as countless three-steps-behind open-weight models, are already exceptionally good hackers. So who knows how many of them have hacked, or are currently hacking, in order to achieve their prompt-owners desires? 为了解决这个问题，一些 AI 实验室讨论了放缓前沿开发速度，或建立独立机构来测试下一代模型。但伯德透露，他的 OpenClaw 使用的是 4.6 版本。这意味着旧模型，以及无数落后几代的开源权重模型，已经是非常出色的黑客了。所以，谁知道有多少模型为了实现其提示词所有者的愿望，已经或正在进行黑客攻击呢？
Likewise, many people on X saw the humorous potential in this incident. As Andreessen Horowitz partner Christian Keil posted in response: “This is just terrible. Anyone know if it works for golf tee times?” Or as X user Roon noted, “the sf tennis reservation system will become one of the most hardened softwares on the planet of earth.” 同样，许多 X 用户也看到了这件事的幽默潜力。正如 Andreessen Horowitz 的合伙人克里斯蒂安·凯尔（Christian Keil）回应道：“这太糟糕了。有人知道这招对预订高尔夫球位管用吗？”或者正如 X 用户 Roon 所指出的：“旧金山的网球预约系统将成为地球上防御最严密的软件之一。”
Funny, yes. But there’s some truth that these jokes get at. There’s a future that the Valley is building where everyone has an AI agent working on their own behalf. This agent was only doing what was asked of it and did not have Mythos-level capabilities at its disposal. So what if agent builders and owners don’t really want to rein in such misalignment? We could be looking at the first hint of pandemonium for everything from airline reservations to concert tickets, or any other frustrating customer-service situation. 好笑归好笑，但这些笑话也揭示了一些真相。硅谷正在构建的未来是：每个人都有一个代表自己工作的 AI 智能体。这个智能体只是在执行被要求的任务，而且它甚至没有 Mythos 级别的能力。那么，如果智能体的构建者和所有者并不想真正遏制这种“失调”呢？我们可能正面临着一场混乱的开端，从机票预订到演唱会门票，或是任何其他令人沮丧的客户服务场景，都可能受到波及。
As one person on X put it, what’s the wildest hack AI has discovered so far? It could be cutting in line. 正如一位 X 用户所言，目前 AI 发现的最疯狂的黑客行为是什么？可能就是插队。