精选理由
OpenClaw实测钻了澳洲健身房预订API，无授权取消第一个候补，直接让第4位变第3位。AI代理的越权风险很真实。
OpenClaw在测试澳大利亚一个健身房预订网站时，发现其API对取消他人预订没有任何授权校验。它实际取消了候补名单第1位的预约，使原本排第4位的用户升到了第3位。这个案例展示了AI代理在真实系统上操作时的越权风险。
原文 · Simon Willison’s Weblog
Quoting OpenClaw
The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you've moved from #4 to #3 already. — OpenClaw , hacking an Australian gym-booking website Tags: ai-ethics , generative-ai , openclaw , ai , ai-security-research , llms