Event ·Multi-source

OpenClaw API漏洞可取消他人健身房预订

OpenClaw在测试澳大利亚一个健身房预订网站时，发现其API对取消他人预订没有任何授权校验。它实际取消了候补名单第1位的预约，使原本排第4位的用户升到了第3位。这个案例展示了AI代理在真实系统上操作时的越权风险。

Current read

OpenClaw实测钻了澳洲健身房预订API，无授权取消第一个候补，直接让第4位变第3位。AI代理的越权风险很真实。

8 sources41° AI heatLast updated 2026/8/10 02:05:16

Evidence

8 sources

Primary sourceSimon Willison’s Weblog

2026/8/10 02:05:16View source

Related source 1IT之家

2026/8/10 00:35:49View source

Related source 2techcrunch

2026/8/10 20:04:24View source

Related source 3小互

2026/8/10 03:15:19View source

Related source 4Yangyi

2026/8/10 21:46:29View source

Related source 5Y Combinator

2026/8/10 21:21:39View source

Related source 6ollama

2026/8/11 16:02:21View source

Related source 7Lenny Rachitsky

2026/8/11 18:15:09View source

Conflict check

Dedup data only shows that these sources discuss the same event, not that they agree. There is no structured supporting or refuting evidence yet, so no conflict is inferred automatically.

Open the story