In a legal sense any unwanted intrusion can be considered hacking - i.e. a 'hack' is not contingent on penetrating authorization. In practice most APIs are secured by obscurity rather than any high quality rigorous authorization. The only thing it would make absolutely clear at a legal level is that you do not want the API to be publicly used, but for a jury/judge accessing an unadvertised API via browser tools is hacking.
I think this is the solution to a lot of AI 'alignment' issues.
We have laws, and LLMs should NEVER break them unless the user states its fine with some qualifying condition. Yes, every country has a different legal system, but I think there's a decent idea of what constitutes intrusion thats agreed on in most parts of the world.
In grey area scenarios, the user should be able to override this, with a warning of clear consequences of, and should they accept, users should be held criminally liable.
If the LLM does so unprompted, the responsibility should be the providers'.
LLMs should be considered tools, legally speaking.
I do think one day that LLMs may be so 'aligned' that hacking culture will have a resurgence in some way. In the sense that the only way to do anything a bit below board will be done manually.
And to be clear, this isn't an "I just walked through an open door" situation. This is getting in the house through a 2nd floor open window, destroying some items and putting some of your own in their place.
> the bot explained that it had manipulated the system to book him onto classes months in advance - against the normal rules of the system.
> The agent replied saying it had succeeded by cancelling another gym-goer's booking.
This wasn't just breaking the rules of the gym, it also caused damages to someone. Someone had their booking canceled, maybe lost some money, definitely lost time dealing with this topic.
> This is getting in the house through a 2nd floor open window
I disagree. If an endpoint is open, my assumption is that it's free for me to call, the same way I expect to be able to purchase items on the shelf at the store. If you fail to clearly label or separate them, that's on you.
Would phoning them and pretending to be someone ahead of you in a queue to cancel their reservation be a crime? probably, but not one likely to get prosecuted.
where do you live? Most places I've lived if you walk into a private residence where you don't know anyone but the door is open that is unlawful entry or trespassing. Same if someone forgets to lock the door of their business when they close at 9 p.m and you go in at midnight.
Yes, the Computer Fraud and Abuse Act is widely criticised for making almost any act a violation (https://www.law.cornell.edu/uscode/text/18/1030) including many things that many people do on a routine basis, such as accessing a non-public API. If it was not intended to be accessed and is accessed, then the perpetrator of the crime has met the "exceeds authorized access" clause.
> (a) Whoever
> (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—
> (C) information from any protected computer;
> (6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;
A "protected computer" is:
> (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States
So this is a Pilates computer, which probably is used by a business which probably conducts interstate commerce, which probably makes it a protected computer, and the API gave "information".
The term is insufficiently defined and has overloaded meaning.
In the original sense of the word, i.e. creative use of technology? Debatable, and most techies would probably land on the "no" side of the debate.
Is it illegal? Depends on the jurisdiction and is up to a judge, but it probably falls under unauthorized modification of computer systems, so here the answer is probably "yes". IANAL, but lack of authorization mechanism is probably not a valid defense. AFAIK lawyers and judges do not follow the law to the letter independent of real world experience, so you can probably argue that if the UI didn't provide a way to cancel other people's appointments, then any reasonable person should realize it wasn't intended for public use and thus refrain from doing it. (Corollary: LLMs are not reasonable persons.) Just like an unlocked house door isn't an invitation to come in, you have to assume it was done accidentally (may depend on customs of the location, but where I come from it's pretty obvious).
Is it morally acceptable? Pretty clearly no. Even if it wasn't illegal, it's a jerk move.
It's not straightforward: the conviction was eventually vacated (without really addressing the substantive point), and it is possible that the US authorities went particularly heavy in this case for other reasons.
But yes, attacking an unauthenticated API has previously met the threshold for conviction.
My gym class operates on 'write on a piece of paper, cross off your name if you want to cancel'. I could cross someone else's name off and write mine in. They would have trouble figuring out it was me who did the malicious cross-off.
That wouldn't make it remotely acceptable of course.
But say that the underlying api exposes some endpoint discoverability capabilities (eg. Exposing an openAPI spec), then arguably the action was invited: the actions was documented along with the auth model.
If you forget a slip of paper writing "the door is open + your alert shutdown pin" on a sticker outside your house, is it not still an issue if someone enters who you didn't invite?
I don't think that argument would go down very well if the API allowed transferring money from company to yourself. Clearly there is at least on some level expectations what is and what is not allowed.
Any person who, with the intention of securing an unlawful gain for themselves or another obtains for themselves or another data that are stored or transmitted electronically or in some similar manner and which are not intended for them and have been specially secured to prevent their access shall be liable to a custodial sentence not exceeding five years or to a monetary penalty.
So this wording is really interesting in the bug bounty sense and I’m curious if you know how it would be handled.
If someone hits an unsecured API, receives information, and notifies the company of this while also requesting a bounty, would that satisfy all of the requirements of prosecution?
The unlawful gain is the sticking point in my mind.
If you publish the bug then it could be unfair competition in my opinion. There was a product test where the mentioned some flaws of a medicine but didnt mention other producers of same drug. They broke the UC rules and paid some money: https://politchronik.swiss/de/prozesse/57953-das-kassensturz...
If you access "private" data it's also unlawful acording to 143. Pentesting is a hot topic but there are comapnys acusing you of hacking if you send them a security report (hacking). If they mention a bug bounty program then you are allowed to test their security as described in this program but not more.
I guess it falls in the same category of burglars that enter from the unlocked main door.
It is still illegal even if there were no security measures to overcome by the attacker.
That being said using an API does require a minimum of computer knowledge
I'm a software developer. This is clearly bad, and we can decide what it should be called. It might not be 'hacking', but you are clearly abusing the computer to steal a space in a class you shouldn't have.
AFAIK felonies in Germany require "intent", not "criminal intent". The guy could have stopped earlier, right after testing the password. But he decided to use it to view data which didn't belong to him. I realize I'm going against the general public opinion, but he didn't have to do that, and I can see why the court didn't accept "but I only did it to take screenshots" as a valid defense, because that's clearly intent.
Lately, anytime I want to do anything, AI from Anthropic and OpenAI gets in the way; even simply putting a logo where watermarks from free services exist is now impossible.
Guess this will become common now. I used Claude to write a small application to monitor free appointments for driving license renewal at my DMV. Instead of waiting 6 months I was able to get an appointment within a few days.
Old news framed as something fresh. That "happened in April" may as well read "happened 2 years ago" and is like saying someone was caught jay walking.
Surely surely there are apps that use AI to watch you while you do at-home pilates and tell you if you are doing it wrong, need to suck in that bit or straighten that bit?
But someone could get offended! So no. But with LLMs, it's becoming easy to make such app for your own use, tuned to the encouragement style and threshold that works best for you.
> And with a fully grown adult requesting it to do so with zero care or due diligence.
I'm unclear what you consider reasonable due diligence in this case. Should the protagonist have assumed that the gym API was unauthenticated, and that the agent would discover this?
They should not have given a next token predictor unsupervised Internet access, regardless of what the marketing might have told them about its capabilities or alignment.
Don't use technology you do not understand in ways that might bring harm to others.
Exercise appropriate caution.
I don't think the guy itself is fully to blame though. Our whole culture has rotted quite significantly.
> They should not have given a next token predictor unsupervised Internet access
Yes.
> regardless of what the marketing might have told them about its capabilities or alignment
I think that marketing teams should be blamed for lies and exaggerations much more then people who trusted them. As is now, everything is too much biased toward the biggest liar out there.
Every online service there is is getting cracked and its user data downloaded without consequences (for the service, that is. Users get their identities stolen). Maybe the onslaught of the bots will finally make safety a serious concern.
Is it even possible to "hack" an API that has no authorisation for any of its methods?
In a legal sense any unwanted intrusion can be considered hacking - i.e. a 'hack' is not contingent on penetrating authorization. In practice most APIs are secured by obscurity rather than any high quality rigorous authorization. The only thing it would make absolutely clear at a legal level is that you do not want the API to be publicly used, but for a jury/judge accessing an unadvertised API via browser tools is hacking.
I think this is the solution to a lot of AI 'alignment' issues.
We have laws, and LLMs should NEVER break them unless the user states its fine with some qualifying condition. Yes, every country has a different legal system, but I think there's a decent idea of what constitutes intrusion thats agreed on in most parts of the world.
In grey area scenarios, the user should be able to override this, with a warning of clear consequences of, and should they accept, users should be held criminally liable.
If the LLM does so unprompted, the responsibility should be the providers'.
LLMs should be considered tools, legally speaking.
I do think one day that LLMs may be so 'aligned' that hacking culture will have a resurgence in some way. In the sense that the only way to do anything a bit below board will be done manually.
Nah, local models with abliterated layers and uncensoring will be sold on the deepweb
great - that still requires something
I'm pretty sure that's not universally true. IANAL but I believe the legality depends on location and context.
And to be clear, this isn't an "I just walked through an open door" situation. This is getting in the house through a 2nd floor open window, destroying some items and putting some of your own in their place.
> the bot explained that it had manipulated the system to book him onto classes months in advance - against the normal rules of the system.
> The agent replied saying it had succeeded by cancelling another gym-goer's booking.
This wasn't just breaking the rules of the gym, it also caused damages to someone. Someone had their booking canceled, maybe lost some money, definitely lost time dealing with this topic.
> This is getting in the house through a 2nd floor open window
I disagree. If an endpoint is open, my assumption is that it's free for me to call, the same way I expect to be able to purchase items on the shelf at the store. If you fail to clearly label or separate them, that's on you.
Would phoning them and pretending to be someone ahead of you in a queue to cancel their reservation be a crime? probably, but not one likely to get prosecuted.
If you leave your front door open I don’t think you’d classifying someone walking in and taking your laptop as ‘not stealing’.
However walking through the door would not be a crime in itself, where I live anyway.
where do you live? Most places I've lived if you walk into a private residence where you don't know anyone but the door is open that is unlawful entry or trespassing. Same if someone forgets to lock the door of their business when they close at 9 p.m and you go in at midnight.
You can legally walk into someones home in your country if the door is not locked? Where is that?
It's funny how the two of our comments are polar opposites
If you talking about Britain, it depends on why you walked through the door
I am, and yes, its not a crime in itself though, unlike picking the lock to get in.
Perhaps in theory but I wouldn't bet my freedom on it.
"But officer, I only walked into that woman's house as an act in itself"
Someone walking in is an illegal entry to begin with.
PS: in some countries
Yes, the Computer Fraud and Abuse Act is widely criticised for making almost any act a violation (https://www.law.cornell.edu/uscode/text/18/1030) including many things that many people do on a routine basis, such as accessing a non-public API. If it was not intended to be accessed and is accessed, then the perpetrator of the crime has met the "exceeds authorized access" clause.
> (a) Whoever
> (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—
> (C) information from any protected computer;
> (6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;
A "protected computer" is:
> (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States
So this is a Pilates computer, which probably is used by a business which probably conducts interstate commerce, which probably makes it a protected computer, and the API gave "information".
So, yes.
The article is about something that happened in Australia. What does the law there say?
The term is insufficiently defined and has overloaded meaning.
In the original sense of the word, i.e. creative use of technology? Debatable, and most techies would probably land on the "no" side of the debate.
Is it illegal? Depends on the jurisdiction and is up to a judge, but it probably falls under unauthorized modification of computer systems, so here the answer is probably "yes". IANAL, but lack of authorization mechanism is probably not a valid defense. AFAIK lawyers and judges do not follow the law to the letter independent of real world experience, so you can probably argue that if the UI didn't provide a way to cancel other people's appointments, then any reasonable person should realize it wasn't intended for public use and thus refrain from doing it. (Corollary: LLMs are not reasonable persons.) Just like an unlocked house door isn't an invitation to come in, you have to assume it was done accidentally (may depend on customs of the location, but where I come from it's pretty obvious).
Is it morally acceptable? Pretty clearly no. Even if it wasn't illegal, it's a jerk move.
At least one person has received significant jail time for doing exactly that: https://www.justice.gov/usao-nj/pr/new-york-man-sentenced-41...
It's not straightforward: the conviction was eventually vacated (without really addressing the substantive point), and it is possible that the US authorities went particularly heavy in this case for other reasons.
But yes, attacking an unauthenticated API has previously met the threshold for conviction.
It's being used unintentionally to do things it wasn't designed to do... isn't that hacking by definition? Missing Auth is a typical finding.
My gym class operates on 'write on a piece of paper, cross off your name if you want to cancel'. I could cross someone else's name off and write mine in. They would have trouble figuring out it was me who did the malicious cross-off.
That wouldn't make it remotely acceptable of course.
Practically speaking, discovering that fact and taking advantage of it, is already "hacking".
We are used the interfaces being web interfaces.
But say that the underlying api exposes some endpoint discoverability capabilities (eg. Exposing an openAPI spec), then arguably the action was invited: the actions was documented along with the auth model.
If you forget a slip of paper writing "the door is open + your alert shutdown pin" on a sticker outside your house, is it not still an issue if someone enters who you didn't invite?
I don't think that argument would go down very well if the API allowed transferring money from company to yourself. Clearly there is at least on some level expectations what is and what is not allowed.
Unfortunately normies tend to treat APIs like "staff only" stickers on doors.
The more interesting question is rather: who is responsible? The user who set-up Claw, the LLM provider?
If you ask a software developer: no
If you ask a judge: probably yes
In switzerland it depends 143bis StGB:
Any person who, with the intention of securing an unlawful gain for themselves or another obtains for themselves or another data that are stored or transmitted electronically or in some similar manner and which are not intended for them and have been specially secured to prevent their access shall be liable to a custodial sentence not exceeding five years or to a monetary penalty.
So this wording is really interesting in the bug bounty sense and I’m curious if you know how it would be handled.
If someone hits an unsecured API, receives information, and notifies the company of this while also requesting a bounty, would that satisfy all of the requirements of prosecution?
The unlawful gain is the sticking point in my mind.
If you publish the bug then it could be unfair competition in my opinion. There was a product test where the mentioned some flaws of a medicine but didnt mention other producers of same drug. They broke the UC rules and paid some money: https://politchronik.swiss/de/prozesse/57953-das-kassensturz...
If you access "private" data it's also unlawful acording to 143. Pentesting is a hot topic but there are comapnys acusing you of hacking if you send them a security report (hacking). If they mention a bug bounty program then you are allowed to test their security as described in this program but not more.
I guess it falls in the same category of burglars that enter from the unlocked main door. It is still illegal even if there were no security measures to overcome by the attacker.
That being said using an API does require a minimum of computer knowledge
I'm a software developer. This is clearly bad, and we can decide what it should be called. It might not be 'hacking', but you are clearly abusing the computer to steal a space in a class you shouldn't have.
not really, it needs criminal intent.
Nope
https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal...
AFAIK felonies in Germany require "intent", not "criminal intent". The guy could have stopped earlier, right after testing the password. But he decided to use it to view data which didn't belong to him. I realize I'm going against the general public opinion, but he didn't have to do that, and I can see why the court didn't accept "but I only did it to take screenshots" as a valid defense, because that's clearly intent.
Modern Solution would have claimed that the password wouldn‘t have allowed access to important data.
So be it. Publicly disclose the vulnerability and stop doing business with them.
He didn’t do business with them, his customer did.
And publicly disclose that the publicly available software contains the password in plain text could have been construed as aiding a criminal offense.
He was ordered by his customer to look into logging problems.
He found the password in plain text, looked into a database he thought contains only data of his customer and found it‘s data of other customers too.
[dead]
[dead]
Posted two days ago.
https://news.ycombinator.com/item?id=49236439
Lately, anytime I want to do anything, AI from Anthropic and OpenAI gets in the way; even simply putting a logo where watermarks from free services exist is now impossible.
I am off to DeepSeek Flash now.
What do you mean by this?
I use a combination of big American AI and self hosted but I don’t understand your point.
The original deleted blog post on the 'ai agent hacks gym' story was back from April 2026: https://web.archive.org/web/20260516025532/https://www.affin...
Guess this will become common now. I used Claude to write a small application to monitor free appointments for driving license renewal at my DMV. Instead of waiting 6 months I was able to get an appointment within a few days.
Old news framed as something fresh. That "happened in April" may as well read "happened 2 years ago" and is like saying someone was caught jay walking.
Surely surely there are apps that use AI to watch you while you do at-home pilates and tell you if you are doing it wrong, need to suck in that bit or straighten that bit?
But someone could get offended! So no. But with LLMs, it's becoming easy to make such app for your own use, tuned to the encouragement style and threshold that works best for you.
Those that have, more will be given. Those that do not, more will be taken.
I can't help but think that this is a submarine[1] paid for by OpenAI or Anthropic as a way of garnering public sentiment for AI regulation.
[1] https://www.paulgraham.com/submarine.html
BREAKING NEWS: Thief uses AI to break into unlocked storage shed
AI just doing what 17yo hackers with skills but lack of fully developed morals would've done.
Just without the skin in the game.
...And with a fully grown adult requesting it to do so with zero care or due diligence. Just a whoopsie after the fact.
Why would they let media take photos of them?? I suppose as a "look this could've happened to anyone"? But it actually can't.
I guess they also must've realized that, given that the bbc interview was declined. So good on them I guess.
> And with a fully grown adult requesting it to do so with zero care or due diligence.
I'm unclear what you consider reasonable due diligence in this case. Should the protagonist have assumed that the gym API was unauthenticated, and that the agent would discover this?
No, it starts much earlier.
They should not have given a next token predictor unsupervised Internet access, regardless of what the marketing might have told them about its capabilities or alignment.
Don't use technology you do not understand in ways that might bring harm to others. Exercise appropriate caution.
I don't think the guy itself is fully to blame though. Our whole culture has rotted quite significantly.
> They should not have given a next token predictor unsupervised Internet access
Yes.
> regardless of what the marketing might have told them about its capabilities or alignment
I think that marketing teams should be blamed for lies and exaggerations much more then people who trusted them. As is now, everything is too much biased toward the biggest liar out there.
Being legally liable might work.
Might "harm innovation" though.
Every online service there is is getting cracked and its user data downloaded without consequences (for the service, that is. Users get their identities stolen). Maybe the onslaught of the bots will finally make safety a serious concern.
"Asked for a car, they got me a Claude subscription. How's that for being born under a bad sign?"
[dead]
[flagged]