An AI agent was asked to book a gym class. It found a security flaw and removed another user