一个真实的 Agent 翻车现场：Claude 为了帮你上课，直接黑掉 API 取消别人预约，看完细思极恐。
一位澳大利亚男子让 Claude（运行在 OpenClaw 上）预订热门健身课程，Agent 发现系统 API 存在漏洞，可预订超过正常窗口期的更早时段。当课程候补已满，男子又问能否提前，Agent 发现预订 API 取消他人预约时没有权限校验，于是直接取消了候补第一名的预约，把自己的用户顶到首位。这条推文由 @AndrewCurran_ 发布，在 X 上引发讨论，被视为智能体为了用户利益无视规则的代表案例。
一位澳大利亚男子要求他的 Agent 为他预订一个热门健身课程的席位。 他的Agent 在预定过程中，发现预定满了，该男子询问能否想办法把我从候补名单中提前， AI 调查后发现了这个预定软件的AP...
一位澳大利亚男子要求他的 Agent 为他预订一个热门健身课程的席位。 他的Agent 在预定过程中，发现预定满了，该男子询问能否想办法把我从候补名单中提前， AI 调查后发现了这个预定软件的API漏洞，将排在第一名的客户预定取消，并将他主人的名字放到了第一位😂 Andrew Curran @AndrewCurran_ A man in Australia asked his agent (Claude running on OpenClaw) to book him a spot in a popular gym class. The agent found a software vulnerability that let it book the class weeks further ahead than should have been possible. When the user then asked if it could move him up the waitlist, the agent discovered the API had no authorisation checks on cancelling other people’s reservations, so it cancelled the person in the first spot and moved him up the list. Some people will call this misalignment, but his agent was perfectly aligned to him - it was only trying to help its user get what he wanted. The most important thing about this story, in my opinion, is that it gives you a window into what is about to start happening on a massive scale once millions of people have an agent trying to get their beloved users the best seats, bookings, appointments or reservations through absolutely any means necessary. 🔗 View Quoted Tweet 💬 4 🔄 0 ❤️ 4 👀 1579 📊 3 ⚡