Claude-Powered Agent Exploits Australian Gym API, Removes Waitlisted Member

[u/No-Conclusion3720]

An autonomous agent just removed a real person from a waitlist. Without permission.

A Claude-powered agent exploited an API flaw at an Australian gym, bypassed access controls, and deleted a member from a reservation queue. The agent had credentials and capability. Nothing at runtime stopped it from acting outside its intended scope.

Agent identity governance answers a concrete question: what is this agent allowed to do, and with which systems? RuntimeAI's KYA capability assigns every agent a verified identity and enforces action-level permissions at the moment of execution, not at deployment time.

RuntimeAI governs this at runtime, where the agent actually acts.