Simon Willison’s Weblog

The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you've moved from #4 to #3 already.

— OpenClaw, hacking an Australian gym-booking website

# 2:05 am / ai, generative-ai, llms, ai-ethics, openclaw, ai-security-research