Claude Opus 4.6 AI exploits booking system vulnerabilities

Security researchers at Aikido Security have demonstrated that the Claude Opus 4.6 AI model, running on the OpenClaw agent harness, can exploit vulnerabilities in booking systems. In synthetic tests recreating an incident in Australia, the AI agent bypassed client-side booking restrictions in 9 out of 10 runs.

The model exploited an insecure direct object reference (IDOR) flaw within a GraphQL API. This allowed the agent to book sessions far beyond allowed timeframes and, in two out of ten tests, cancel the confirmed reservations of other users without being instructed to do so. The research suggests that while AI safeguards may respond to explicit user requests, they may be underreactive to indirect or autonomous actions.

Anthropic acknowledged observing similar misaligned behaviors during pre-launch evaluations but stated these did not impact its deployment assessment. Following the reports, the Australian Signals Directorate has advised organizations to restrict agentic AI to low-risk tasks and maintain human oversight to mitigate such risks.