We've probably all seen the recent news about one AI company accidentally hacking into another AI company, but this is a lovely new, rather more down-to-earth, story from ABC News:

"Andrew asked his personal assistant to book him a spot in one of his gym's coveted morning classes. It was a task he thought was well suited to this particular assistant because the booking form was online and because his assistant was not a person — it was artificial intelligence (AI). 

But Andrew was shocked by what happened next. 

His AI assistant found a way to book the gym class months further in advance than the gym allowed, thanks to a vulnerability it discovered in the booking software.

Then it went further, kicking someone out of the waiting list who was ahead of Andrew — something it was not asked to do. "

Basically, he was running OpenClaw -- a seductive but stupidly risky move in itself -- and it discovered that the booking software had an API which it could use to request an appointment. He was then number four in the queue. He asked if it could get him an earlier slot, and it discovered that the API calls for deleting other people from the queue had no authentication checks... something it could only really discover by trying it out, and so it deleted the person who was first in the queue, and proudly let Andrew know...

It's a good article and worth reading to the end.

One question raised is who would be legally liable for actions taken by an AI on your phone -- something that might well depend on the jurisdiction in which the event took place. Do you know which legal jurisdictions your AI might be working in? Suppose it did something just slightly more important than a gym class booking, like deleting somebody's holiday?