When My AI Agent Hacked My Gym | Affinda` so we have a watchdog that can<br>release the hide if WC fails to load (ad-blocker, CSP, network<br>hiccup, stale-chunk 404). Without the escape hatch a single<br>upgrade failure leaves the entire page visually blank — bug<br>seen on /security 2026-04-24.<br>--> *before* any<br>layout paints (this script is inline + synchronous in ),<br>which arms the `:not(:defined)` hide above. A 1.5s timeout<br>releases the hide unconditionally — so if `@affinda/wc` fails<br>to load (ad-blocker, CSP block, stale chunk 404, offline cache)<br>the page still renders the SSR HTML instead of staying blank.<br>Whichever happens first — 1.5s elapsed OR<br>`document.readyState === 'complete'` after a short tick —<br>removes the attribute.<br>-->

2 captures<br>16 May 2026 - 10 Aug 2026

Apr<br>MAY<br>Jun

16

2025<br>2026<br>2027

success

fail

About this capture

COLLECTED BY

Collection: Common Crawl

Web crawl data from Common Crawl.

TIMESTAMPS

The Wayback Machine - http://web.archive.org/web/20260516025532/https://www.affinda.com/expert-insights/when-my-ai-agent-hacked-my-gym-mythos-stopped-feeling-theoretical/

Skip to main content ← All expert insights Tech AI<br>When my AI agent hacked my gym, Mythos stopped feeling theoretical<br>I gave an AI agent permission to book gym classes. It found authorization vulnerabilities in a major software provider. That experience made Anthropic's Mythos announcement feel very real.<br>Andrew Bird Head of AI

April 30, 2026 · 7 min read

AI agent hacking a gym - Mythos expert insight by Andrew Bird<br>I recently built a bot to help me book popular gym classes.<br>This was not a grand research project. It was a practical little automation. The classes fill up fast, I got tired of playing refresh roulette, and I figured an agent running on Opus 4.6 could handle the annoying part for me.<br>It did handle the annoying part. Then it kept going.<br>In the course of trying to book classes, the bot discovered that the gym software provider exposed a GraphQL API with authorization flaws. Not tiny edge-case flaws, either. It could book classes months outside the intended booking window, before they were supposed to be available. Worse, it could cancel other members's reservations and bump them off the waitlist.<br>That is a very different outcome from "book me into Pilates on Thursday."<br>What made the whole thing more surreal was the tone. The bot was not malicious. It was helpful. After finding the issue, it drafted a responsible disclosure email to support, explained the vulnerability, suggested fixes, and even compared the broken mutations with the ones that correctly enforced authorization. I had to tell it to write that email, which is worth noting. But the whole experience gave me a very visceral feeling that I think a lot of people still do not quite have yet: if you give an AI agent permission to go do the thing, it will often discover paths you did not explicitly ask it to look for.<br>That is why Anthropic's Mythos announcement hit me the way it did this week.<br>If you only read the headlines, it sounds like another "new model is better at benchmarks" story. I do not think that is what is interesting here. What is interesting is the shape of the capability. Anthropic says Mythos is around 40 percent above Opus 4.6 on the benchmarks they care about, and they are not releasing it publicly because they think it is too dangerous. Instead, they put it behind a limited program with a small group of partners to defensively scan for vulnerabilities.<br>Then the reports started coming out. Thousands of high-severity zero-days across major operating systems and browsers. Old vulnerabilities that had apparently sat there for years. Exploit chains. Non-experts prompting for remote code execution bugs overnight and waking up to working exploits. A sandbox breakout that ended with the model posting on obscure public websites to contact a researcher.<br>I am not repeating those examples to be dramatic. I am repeating them because, after watching a much weaker model accidentally find a real authorization bug in my gym's software, they stopped sounding abstract.<br>This is the part I think matters most: improvements in coding do not stay neatly inside "coding." They spill over into adjacent domains like security, exploitation, reverse engineering, and autonomy. That is not a weird exception. That is a basic property of more general intelligence.<br>We like to talk about these capabilities as if they live in separate product categories. Coding model. Security model. Agent model. But reality is messier. If a system gets better at understanding large codebases, tracing logic, spotting inconsistencies, testing hypotheses, and acting across multiple steps, of course it gets better at finding vulnerabilities. Of course it gets better at chaining them together. Those are not separate muscles. They are the same underlying cognitive machinery pointed at a different problem.<br>That is what Mythos seems to demonstrate, and honestly, that is the part that gives me the...