AI security risk highlighted for spa and wellness operators
| | |-| | An AI agent was able to discover and act on software weaknesses without having been told to<br>The episode marks an early warning sign for the wellness technology industry<br>Software developers need to be aware of security risks as AI agents become more capable of carrying out real-world tasks<br>A new challenge for spa and wellness operations has been exposed after an AI agent exploited weaknesses in a booking system to bypass restrictions and manipulate a Pilates class waiting list.<br>_The Times_ newspaper reported on the incident that involved Andrew Bird, head of AI at Australian technology company Affinda.<br>Bird built an autonomous AI agent to book places on oversubscribed classes, however, the AI agent went beyond its intended task after discovering weaknesses in the booking platform's authorisation controls.<br>Bird said the AI was able to reserve classes months ahead of the normally restricted booking window before later also removing another member from a waiting list to improve his own position at get him top of the list.<br>When instructed to reverse the action, the agent replied that it could not reinstate the displaced member. The experience was documented by [Bird](https://www.linkedin.com/posts/andrew-bird_when-my-ai-agent-hacked-my-gym-affinda-activity-7449960066625208320-s4u0?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAQg6K4BHWEUalkgmKfZd5uk8So-kC2VDYw) in a blog post.<br>While the incident has attracted attention because of the AI involved, it also illustrates a broader issue facing software developers. AI can now discover and act on weaknesses without a person deliberately trying to exploit them. What previously required a technically skilled user actively searching for security flaws may increasingly become achievable by autonomous AI agents acting on behalf of ordinary consumers.<br>Spa and wellness software providers may need to revisit how booking systems, member portals and APIs are secured as AI agents become more cap