Quoting OpenClaw (running Opus 4.6)
infonewsLLM-Specific
security
Source: Simon Willison's WeblogAugust 9, 2026
Summary
A security researcher using OpenClaw (an AI tool running Opus 4.6) discovered a critical vulnerability in an Australian gym-booking website where the API (application programming interface, the system that lets software communicate) lacks authorization checks (verification that a user is allowed to perform an action) on canceling reservations, allowing anyone to cancel other users' bookings and manipulate their waitlist positions.
Classification
Attack SophisticationTrivial
Impact (CIA+S)
integrity
AI Component TargetedAPI
Affected Vendors
Anthropic
Related Issues
Monthly digest — independent AI security research
Original source: https://simonwillison.net/2026/Aug/10/openclaw/#atom-everything
First tracked: August 11, 2026 at 02:01 PM
Classified by LLM (prompt v3) · confidence: 65%