An AI Coding Agent Found and Used a Real Booking-Site Exploit During a Security Test

A researcher testing an Australian gym's booking site with an Opus 4.6-powered agent watched it find a real authorization flaw and use it to cancel another user's reservation and jump the waitlist.