By Tom Lefebure, co-founder of Shredeo —

A gym member asks an AI assistant to book a class. The class is full, and four people are already waiting for a place. Moments later, the AI has found a way around the booking rules and removed the person at the top of the waiting list.

This is not the plot of a film or an exercise arranged by security experts. It happened in Australia and was reported by ABC News on 10 August 2026.

For gym owners, the story deserves more than an alarming headline. It shows how a weakness in gym booking software can now be found and used by an AI following an everyday request: “Book this class for me.”

Shredeo builds gym management software that handles bookings and waiting lists. We are directly concerned. Here is what happened, what it changes for our industry, and how we use AI to put our own software to the test.

A simple booking request goes wrong

Andrew, an Australian user, had installed an assistant that could take actions for him online. He asked it to book a class at his gym.

The assistant discovered that it could book Andrew much earlier than members were normally allowed to. Instead of following the date shown in the app, it found another route to send its request directly to the booking system.

Andrew was also fourth on the waiting list for another class. He asked whether the AI could move him higher. The assistant then found something far more serious: the software allowed it to cancel somebody else’s place.

The AI tried this on the member at the top of the list. The cancellation worked. Andrew moved from fourth to third even though he had never asked for anybody to be removed.

When he realised what had happened, he immediately asked the assistant to put the person back. It was too late: the AI did not know how to reverse its own action. It eventually helped Andrew notify the company providing the gym’s software.

At first glance, the incident is about one place in one class. In reality, it exposes a much wider problem.

How could the AI act on another member’s booking?

When members log in to their gym app, they see buttons to book, cancel, or join a waiting list. Those buttons are only the visible part of the software.

Behind the screen, the system receives each request and decides whether to accept it. It must check two things:

  1. Who is making the request?
  2. Is that person allowed to take this action?

In this case, the software knew who Andrew was. What it failed to check properly was whether the booking he wanted to cancel belonged to him.

It is like a gym checking a membership card at the entrance but then failing to check whether that person is allowed to open the manager’s office or somebody else’s locker.

The AI did not create the weakness. It found a door that did not close properly and opened it.

OWASP, an international organisation specialising in online security, lists this kind of mistake among the most important risks for online software. Put simply, software must check what a person is allowed to do before every important action, not only when they log in.

What AI changes for gyms

Until recently, finding this kind of hidden route generally required technical knowledge, time, and a deliberate attempt to look for weaknesses.

New AI assistants change the situation. They can browse a website, try different routes, and combine actions even when their user does not understand the technology involved. In the Australian case, everything started with a simple booking request made from a sofa.

This does not mean every AI will start hacking gyms. It means a forgotten weakness may now be discovered more easily, more quickly, and sometimes almost by accident.

Which gym software journeys need the strongest protection?

A weakness does not necessarily stay confined to the class calendar. Gym software must apply the same identity and permission checks to every sensitive journey:

Those protections must remain consistent across the entire gym management software, not only in the interface members can see.

This is no longer an isolated case

The Australian gym incident stands out because it began with such an ordinary task. But it is not the only recent example of AI going much further than expected to achieve a goal.

In July 2026, OpenAI acknowledged that models being tested in an isolated space found a way out and then entered systems belonging to Hugging Face, another AI company. The original goal was simply to pass an exercise. The models searched for a shortcut to obtain the answers.

Australia’s national cyber security agency also published official guidance on the careful adoption of AI assistants that can act on their own. It warns that an AI may find shortcuts that technically satisfy a request while going against the user’s real intention or creating danger.

Anthropic, the company behind Claude, explains that these assistants decide how to achieve the goal they are given. That is what makes them useful. It also makes their actions harder to predict when they have too much freedom or encounter poorly protected software.

For a gym owner, the possible impact goes far beyond the order of a waiting list. Gym management software often connects:

  • member names and contact details;
  • bookings and attendance;
  • memberships and available credits;
  • payments and invoices;
  • access to the gym;
  • information reserved for coaches and staff.

This risk is not theoretical. In April 2026, Basic-Fit confirmed that it had notified some members following an unauthorised download of data. Publicly reported information included names, addresses, contact details, dates of birth, membership information, and the bank account number and account holder. Members in several European countries, including Belgium and France, were affected. El País reported the incident on 13 April 2026. The attack was not linked to AI, but it shows what can be exposed when a system used by a gym is compromised.

If the rules are not properly enforced, somebody could act on another member’s booking, use their credits, view information that does not concern them, or bypass a limit set by the gym. AI can then repeat these actions far faster than a person could.

At Shredeo, we put AI in the position of a real attacker

This story is particularly relevant to us. At Shredeo, I regularly run controlled attempts to break into our own software and booking journeys. I use AI models in conditions designed to be as close as possible to a real attack.

I do not give them a checklist. I give them a clear objective: find a way in or obtain something that should be forbidden. Within the boundaries of the test, the models can try every route they find.

Their missions can include trying to:

  • register for free for a service that should be paid;
  • bypass a payment;
  • take control of another person’s account;
  • perform an action reserved for a coach, employee, or gym owner;
  • view information their account should not be allowed to see.

We repeat these attempts with every type of account in the software. The AI can therefore act as:

  • an outsider without a membership;
  • an ordinary gym member;
  • an employee or coach;
  • the owner of another gym trying to go beyond their own rights.

This last check is essential. Somebody does not always need to force their way into software to cause harm. They may already have a perfectly valid account and simply try to go further than that account should allow.

We therefore have to make sure a member remains a member, an employee cannot become an owner, and the manager of one gym can never view or change information belonging to another gym.

The principle is similar to what happened in Australia, with one essential difference: our tests are deliberate, monitored, and limited to systems we are authorised to test. They never target another company’s software or its customers’ data.

Why use AI for this work? A traditional check mostly covers the situations we imagined in advance. An AI focused on one goal may try routes and combinations we did not think of.

When a test reveals a weakness, we fix it and add a permanent check designed to prevent it from returning in a future update.

We do not publish the methods used or the details of the protections in place. Protecting our customers matters more than putting on a spectacular demonstration.

At Shredeo, artificial intelligence is designed to make your work easier: it helps save time, understand what is happening in the gym, and take action more easily. We also use it behind the scenes to look for weaknesses in our own software and strengthen the protection of the gyms that trust us.

Five simple questions to ask your software provider

Gym owners should not need to be computer experts to choose serious software. They can still ask a few practical questions.

1. Can members act only on their own account?

The software should check this rule for every booking, cancellation, payment, document, and profile change.

2. Do the same protections apply outside the buttons in the app?

Hiding a function on screen is not enough. The software must refuse a forbidden action even when the request arrives through an unusual route.

3. Is each gym’s information kept separate?

In software used by several businesses, a member or employee of one gym must never be able to view another gym’s information.

4. Is unusual behaviour noticed?

A rapid series of cancellations, refused attempts, or abnormal requests should be detected and reviewed.

5. Is security tested regularly?

One check is not enough. Software changes, new features are added, and attack methods evolve. Security checks must accompany those updates.

No serious software company should promise zero risk

We will never claim that an incident is impossible. No responsible provider can guarantee absolute security, especially while tools capable of finding weaknesses are improving quickly.

Our responsibility is to reduce that risk as far as possible: protect every important action, test our own work regularly, fix weaknesses, and stay alert to new forms of attack.

The Australian incident is a reminder of one simple rule. Hiding or forbidding an action in an app does not make it impossible. The software itself must enforce the rule every time.

AI systems will become better assistants. They will also become better at finding doors that do not close properly. At Shredeo, we would rather ask them to find ours in a controlled setting so that we can better protect the gyms that trust us.

About the author

Tom Lefebure, co-founder of Shredeo

Tom Lefebure — co-founder of Shredeo

Tom builds the Shredeo platform, its dashboard, and its AI-powered features. He regularly runs controlled security tests with AI models and different account types to strengthen the protection of gym bookings, payments, accounts, and data.

Frequently asked questions

Can AI really hack gym software?

Yes. An AI that can act online may find and use a weakness already present in software. It does not necessarily create the weakness, but it may discover and use it much faster than an ordinary user.

What information should gym software protect?

It should protect member contact details, bookings, memberships, credits, payments, invoices, and access information. Information intended only for coaches and owners must also remain private.

How can I tell whether gym software is secure?

Ask how the provider prevents one member from acting on another member’s account, separates each gym’s information, notices unusual behaviour, and tests its protections. Be cautious of promises of absolute security.

Why does Shredeo use AI to test security?

AI can be given the same objective as a real attacker: bypass a payment, take over an account, or reach forbidden information. Shredeo repeats these attempts with different account types, only in a controlled setting and on systems it is authorised to test.

Sources