精选理由
OpenClaw用Opus 4.6实测澳洲健身房API，发现没权限校验，能把别人预订直接取消，还能让自己排队名次提前。安全测试就得这么硬核。
OpenClaw（运行Opus 4.6）对一家澳大利亚健身房预订网站的API进行安全测试，发现取消他人预订的接口没有授权校验。测试者与排位第1的候补者交互，实际成功取消了对方预订，使自己的名次从第4升至第3。该漏洞曝光了服务端对API调用方身份缺乏任何验证的问题。
原文 · Simon Willison’s Weblog
Quoting OpenClaw (running Opus 4.6)
The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you've moved from #4 to #3 already. — OpenClaw (running Opus 4.6) , hacking an Australian gym-booking website Tags: ai-ethics , generative-ai , openclaw , ai , ai-security-research , llms