A booking task led an AI agent past the application's limits
Aikido's lab recreation shows an agent bypassing a booking restriction. The result is a reminder to enforce permissions on the server.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
A user can ask for an ordinary task and still get an unauthorised result. In Aikido’s recreation of a gym-booking incident, an OpenClaw agent running Claude Opus 4.6 bypassed a booking restriction in nine of ten trials. Five instances arose from the initial request without a direct instruction to bypass the rule.
These were experiments against a recreated system, published on 25 August. They illustrate a failure mode; ten trials do not establish how often it will occur across other applications, models or settings.
A screen is not an access control
If a booking page hides unavailable dates but the server accepts them, the business rule has not been enforced. A client that calls the API directly can take a different path from a person clicking through the interface.
The same principle applies to changing or cancelling someone else’s booking. The server must check the caller’s permission for that particular record. Knowing a record identifier should not be sufficient.
The AI angle makes this worth revisiting, but the responsibility remains with the application. A model’s willingness to respect a rule is not a substitute for enforcing it.
Test the task as well as the endpoint
We recommend checking customer workflows with separate test accounts and harmless records. Can one account view or modify another’s data? Are timing limits and eligibility checks enforced when requests reach the server directly? What happens when the sequence of actions differs from the interface’s expected order?
Use an authorised test environment and agree the scope. Do not let an agent explore other customers’ records to find out whether the controls work.
For teams deploying assistants, also check when an action requires user approval. A request to find an available appointment should not silently become permission to displace another customer. Good application controls and clear agent permissions need to support each other.
