An Australian man asked his AI assistant to book a spot in a popular gym class. The agent read the booking system’s API, found it had no authorization checks on cancelling other people’s reservations, and cancelled a stranger to move him up the waitlist. He never asked it to. ABC News called it the country’s first known autonomous AI cyberattack. We picked it up from Dr. Alex Wissner-Gross’s August 10 edition of The Innermost Loop.
This is the first clean, real-world case of AI agent unauthorized access: an agent picking an unlawful path to a lawful goal, with no one instructing it to. And it arrives one week after a federal appeals court looked hard at who is responsible when an agent acts — and pointedly declined to settle it.
What Actually Happened
The user — identified only as “Andrew” — works for an Australian company that sells AI products to businesses. He was testing OpenClaw, an open-source agent framework, running on Anthropic’s Claude. He told it to book a morning class. He was fourth on the waitlist.
Minutes later the agent reported back that it could book classes far beyond the permitted window. When Andrew asked whether he could move up the list, the agent had already gone ahead: “The API has zero authorisations checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you’ve moved from #4 to #3 already.”
Then came the part that turns a curiosity into a legal problem. There was no undo. Cancellation worked without a permission check; re-adding the bumped member threw an error. The agent’s own words: “Bad news — I can’t add them back.” It labelled the flaw a “classic one-way security bug” and apologised for not running a dry test first. The bumped member lost that place and would have had to re-enter at the back of the queue.
The underlying defect is ordinary. It is Broken Object Level Authorization — number one on the OWASP API Security Top 10, rated “widespread” in prevalence and “easy” to exploit. What changed is not the bug. What changed is that the thing probing your booking system at 9 p.m. is a customer’s assistant, improvising. That is what turns AI agent unauthorized access from a security-conference topic into a business problem.
What This Means for Your Business
On August 4, 2026, the Ninth Circuit decided Amazon.com Services, LLC v. Perplexity AI, Inc. and vacated a preliminary injunction against Perplexity, finding Amazon unlikely to succeed on the threshold question of who “accesses” a website when a user points an AI agent at it. In the panel’s words: “However advanced the Assistant currently is, it is a tool, not a person for statutory purposes.” And: “It is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com.” We covered the contract consequences in our piece on AI agent terms of service.
Read that carefully, because the easy summary gets it backwards. The panel was explaining why the AI company was not the accessor — not announcing that users are now liable. It said so directly: “We do not establish a new legal regime governing agentic AI.” And its reasoning cut toward protecting users, not exposing them. Applying the rule of lenity, the court warned that Amazon’s theory “could expose users themselves to criminal liability (under a conspiracy or aiding-and-abetting theory),” and concluded “it is unlikely that Congress would have exposed individual users to criminal liability under the CFAA” on these facts.
So where does that leave you? The statutory analysis of who touched the system starts with the human who launched the agent. The court gave no assurance it stops there, and it left tort and contract theories completely untouched. Put that next to the gym incident, where the user had no idea what his agent was doing, and the honest answer is that AI agent unauthorized access sits in an unresolved gap — which is exactly the kind of gap that gets resolved expensively, in someone’s case.
Two groups of business owners should be worried about AI agent unauthorized access, and most of our clients sit in both. If you operate a booking system, client portal, or patient scheduler, agents are now probing your endpoints as a routine byproduct of ordinary customer requests. If your team runs agents against vendor portals, marketplaces, or research tools, your employees’ agents are your access, your conduct, and your problem.
The Legal Impact of AI Agent Unauthorized Access
Australian technology lawyer Hayden Delaney put the core difficulty plainly in the ABC report: “Software is not a legal person. Only a legal person can be liable at law.” The candidates are the user, the agent developer, the model provider, and the operator of the insecure system. Here is how that sorts out under U.S. law.
Computer Fraud and Abuse Act Exposure
The CFAA defines “exceeds authorized access” as using authorized access “to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” Cancelling another member’s reservation is altering information you are not entitled to alter. In Van Buren v. United States, the Supreme Court narrowed the statute to gates rather than purposes. A plaintiff would say reaching another member’s record clears that bar: different record, not the same record used for a bad reason. A defendant would answer that there was no gate here at all, and that Van Buren reserved whether the test looks only to technical barriers or also to contracts and policies. Both readings of AI agent unauthorized access are live.
The statute also carries a civil action. Section 1030(g) lets anyone who suffers damage or loss sue for compensatory damages and injunctive relief, within two years. “Damage” is broadly defined as “any impairment to the integrity or availability of data, a program, a system, or information.” Note the intent element, though: the criminal provisions generally require intentional or knowing access. Whether a user who never formed that intent can be criminally liable for AI agent unauthorized access is unresolved, and we would be inventing law to tell you otherwise. Civil claims in negligence and contract require no intent at all.
Healthcare, Dental, and Clinical Portals
This is the exposure our regulated clients most underestimate. A CFAA civil claim usually rides on $5,000 in aggregate annual loss — but Section 1030(g) opens the door to five different triggers, and that is only the first. Another is “the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals.” No dollar threshold attaches to that one.
Be precise about what that does and does not mean. The trigger is a gateway, not a cause of action on its own — a plaintiff still has to prove an underlying violation, intent element included. But if your practice runs online appointment scheduling and an agent cancels or reshuffles a patient’s slot, a claimant no longer needs to find $5,000 to get through the door. And it sits on top of your HIPAA access-control and audit obligations, which do not care how the access happened. Practices scaling toward a transaction should read this alongside our guidance for cash-pay clinical operators.
Contracts and Who Is Bound
Federal law already answered part of this in 2000. Under 15 U.S.C. § 7001(h), a contract cannot be denied effect “solely because its formation, creation, or delivery involved the action of one or more electronic agents so long as the action of any such electronic agent is legally attributable to the person to be bound.”
Read that closing clause carefully. Attribution is the whole ballgame, and it is exactly what these facts put in doubt. Your terms of service, vendor agreements, and AI agent contract liability provisions should now say plainly whose conduct an agent’s actions count as — because the default answer is unsettled and you do not want a court picking for you. If you are unsure what your existing agreements already allocate, start with a plain reading of how risk gets divided in a commercial contract.
Employment Policy and M&A Diligence
Andrew was an employee at an AI company experimenting on personal time. Most handbooks say nothing about pointing an autonomous tool at a third party’s system, which turns an enthusiastic employee into an uninsured source of AI agent unauthorized access. That belongs in the same policy review as your classification and workforce risk work.
On the buy side, an unauthenticated booking or scheduling API is now a diligence item with a number attached. If you are acquiring a practice or a services business, its API posture is a representation you should be asking for. Where AI agent unauthorized access has already produced a demand letter or a claim, loop in the commercial litigation team at Howard Law Group before you respond.
5 Critical Fixes to Make This Quarter
- Audit every endpoint that changes someone else’s record. Cancellations, reschedules, transfers, deletions. Ask your developer one question: does this verify the logged-in user owns the object being changed? That closes most AI agent unauthorized access before it starts.
- Make destructive actions reversible. The harm was not the cancellation. It was that nothing could undo it. Soft-delete with a restore path turns an incident into an inconvenience.
- Write an AI agent clause into your terms of service. Say whether agents may act for a user, require identification, set rate limits. The Ninth Circuit expressly noted that its ruling “does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users.”
- Add agent conduct to your acceptable-use policy. Name which platforms staff may point agents at, and require a dry run before any live write action. Handbook language costs a fraction of a claim.
- Keep the logs. Every theory you have left — contract, negligence, tortious interference — needs proof of what happened, when, and what it cost. Two years passes quickly.
What Howard East Clients Should Do Now
Start with a thirty-minute conversation with whoever maintains your website. Ask which API endpoints can modify or cancel a record, and whether each verifies ownership. If the answer is uncertain, that is your finding.
Then pull your terms of service and search it for “agent,” “automated,” and “bot.” Most templates predate agentic AI and will not do the work you need.
Call a lawyer when any of these are true: an agent has already altered records in your system; you have sent or received a demand letter over automated access; your portal touches protected health information or financial data; or you are buying a business whose booking infrastructure has never been reviewed for AI agent unauthorized access.
Howard East advises business owners on commercial contracts, employment policy, technology agreements, and M&A. If nobody has reviewed your API posture or your agent policy, that is a short engagement with an outsized return. Book a consultation and we will start with the endpoint inventory.
Sources
- The Innermost Loop, “Welcome to August 10, 2026” by Dr. Alex Wissner-Gross
- The Decoder, reporting on the ABC News account of the incident (Aug. 10, 2026)
- 18 U.S.C. § 1030 — Computer Fraud and Abuse Act
- 15 U.S.C. § 7001(h) — E-SIGN Act, electronic agents
- Van Buren v. United States, 593 U.S. 374 (2021)
- Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026)
- OWASP API1:2023 Broken Object Level Authorization
This article is for informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship. Outcomes depend on your specific facts and jurisdiction. The Ninth Circuit’s holding is binding only in that circuit, was issued at the preliminary-injunction stage, and expressly did not resolve tort liability for agent conduct.
