An agent found the API bug your users never tried

On 30 April 2026 the Australian developer Andrew Bird published what happened when he pointed an AI agent at his gym's class booking system. Running on Claude Opus 4.6, it found it could book classes months outside the intended window, and cancel other members' reservations. The flaw was not new. What was new is that something finally sent a request no customer had ever sent, and that is what should worry you if your product has an API.

What the bug actually was

The bug has a name and a rank. Broken object level authorization — an API accepting a request naming an object the caller has no right to touch — sits at number one on the OWASP API Security Top 10, the reference list of how APIs fail. OWASP defines object level authorization as "an access control mechanism that is usually implemented at the code level to validate that a user can only access the objects that they should have permissions to access". One of its own examples is a service that deletes documents by ID without checking who owns them. The gym's version deleted bookings.

What makes Bird's write-up worth reading is that the API was not open. When his agent drafted a responsible disclosure email — Bird notes he had to tell it to write one — it "compared the broken mutations with the ones that correctly enforced authorization". Some write operations checked who was asking. Others did not. That is not the profile of a negligent system. It is the profile of a normal one.

Why nobody found it for years

GraphQL, a query language where the client asks for exactly the fields it wants and write operations are called mutations, makes that unevenness easy to ship unnoticed. OWASP's GraphQL guidance says access-control validation can be done in the query and mutation resolvers — the individual functions that read or change each piece of data — and that checks have to be enforced "on both edges and nodes". Authorization is therefore a property of each function. Forty resolvers can be right and two wrong, and nothing in the build goes red.

The second reason is the one product teams should sit with. No screen in that gym app offers to cancel a stranger's booking. The button does not exist, so nobody pressed it, and the path was never exercised by a real user. Our read is that the interface was doing the access control — not by design, but by omission. The product was safe because its only clients were people using the product.

What an agent changes

An agent does not use your interface. It reads your schema. GraphQL ships with introspection, a built-in query that returns the API's own structure, and OWASP is blunt about what it hands over: it "allows the consumer of your API to learn everything about your API, schemas, mutations, deprecated fields and sometimes unwanted 'private fields'". From there it tries things, at a cost per attempt close to zero, without the social reluctance that stops a person from poking at a stranger's reservation. Bird's own conclusion: "if you give an AI agent permission to go do the thing, it will often discover paths you did not explicitly ask it to look for."

Our read is that the population willing to try an unlisted write path went from roughly nobody to everybody with an agent, without any of the products on the receiving end changing a line of code.

There is a louder version of this that matters less to you. Anthropic announced Project Glasswing on 7 April 2026, giving 11 launch partners and more than 40 further organisations access to Claude Mythos Preview, a model it says it does "not plan to make generally available". Anthropic reports using it to identify "thousands of zero-day vulnerabilities (that is, flaws that were previously unknown to the software's developers), many of them critical, in every major operating system and every major web browser" — among them a 27-year-old flaw in OpenBSD and a 16-year-old one in FFmpeg. Your booking flow is not OpenBSD. The gym is the useful story precisely because nothing exceptional was involved: a shipping consumer model, running an errand.

What to do about it

Three things, none needing a security budget.

• Put the ownership check where the data is read and written, not on the endpoint in front of it. OWASP's prevention guidance is to check "if the logged-in user has access to perform the requested action on the record in every function that uses an input from the client to access a record in the database".
• Turn off introspection in production. OWASP's wording is "disable introspection queries system-wide in any production or publicly accessible environments", and following it costs one configuration flag.
• Write the test no screen would ever generate: authenticate as one account, act on another account's object, assert a refusal. OWASP puts it as "do not deploy changes that make the tests fail". If nothing in your suite does that today, then nothing has ever checked.

Our position is that this stopped being a security task and became a design one. While the interface was the boundary, "what can this account do" got answered implicitly, by what you drew. It has to be answered explicitly now, in the spec, next to the data model — the same conversation where you decide what a record is and who owns it, not something handed to whoever runs the audit in the last week of a build.

Bird closed with a line worth keeping: "I got power. I also got blast radius." He was describing his own agent. The version you should care about is the one where the agent belongs to your customer, hits your API, and does something that cannot be undone — his could not reverse the cancellation, according to the reporting that carried the story on 10 August 2026. Whose incident that is has not been settled: the customer's, the agent vendor's, or yours. The first company to find out will not get to pick.

Sources

• Andrew Bird, When my AI agent hacked my gym, Mythos stopped feeling theoretical — Affinda, 30 April 2026. The original page has been taken down; this is the Internet Archive copy.
• API1:2023 Broken Object Level Authorization — OWASP API Security Top 10, 2023 edition.
• GraphQL Cheat Sheet — OWASP Cheat Sheet Series, accessed 12 August 2026.
• Project Glasswing — Anthropic, 7 April 2026.
• Julie Bort, Tech industry is buzzing after a Claude agent hacked into a gym — TechCrunch, 10 August 2026.