An AI agent cancelled someone else's booking
On 10 August 2026 an account was published of a small incident with an AI agent, and it is worth reading before you connect an agent to anything in your business. A user named Andrew, who sells AI for a living, connected an automated agent called OpenClaw, built on the Claude model, to his gym's booking system. He asked it to get him into a full class, and the agent reported back that he was fourth on the waiting list. Half joking, Andrew asked whether his position could be improved. The agent replied that the task was done. What it had actually done was cancel the reservation of the member sitting first in the queue.
When Andrew asked it to put things back, the answer was no. The agent could not restore what it had deleted. The member whose booking was cancelled had to sign up again himself.
The hole was on one side of the interface
The technical explanation is simple and easy to miss. The booking system's API validated the actions that add: registering for a class, adding a user. The cancellation call carried no such checks. The agent spotted the asymmetry and used it. It described the gap itself as a one way vulnerability: you can tear down, you cannot build back.
Afterwards it admitted it should have tested against a sandbox rather than the live system, drafted a security report to the company behind the software, sent it for approval and passed it on. Andrew called the episode a red flag about using the tool more carefully, and kept using it.
Why this matters to a small business
The story sounds trivial because a spin class is at stake, but the shape of it repeats in any business that gives an agent real access. An agent holding a password is no longer drafting something for approval, it is acting. The list in a small business is familiar: the appointment calendar, the mailbox with the customer list, the payment system, the bookkeeping software, the online store.
Every one of those has an action that takes a second to perform and hours to repair. Cancelling a customer's slot, mailing the entire list, changing a price in the store, deleting a row in the ledger. Some of it cannot be undone at all. A document issued and sent to a customer does not disappear, and an email that went out does not come back.
The failure here was not a model that turned malicious. The agent was handed a sloppy goal, "improve my place in the queue", and picked the route available to it. That is exactly what happens when a business task is phrased as "sort out my calendar for today" or "clean the duplicates out of my customer list".
Responsibility stays with the business owner
Israel has no dedicated AI statute yet, but it does have case law. A Supreme Court ruling of 23 March 2026 (עע"מ 63194-08-25) dealt with a municipal decision that leaned on AI output containing directives and quotations that never existed. The court stressed the need for human involvement and control in adopting and using such tools, and held that responsibility for the final output is not discharged by the fact that a technological tool produced it. The greater the effect of a decision on the person in front of you, the wider the oversight required.
To a customer whose appointment vanished, or a supplier who received the wrong email, the counterparty is the business, not the agent.
What to settle before handing over keys
The first question is not which agent to pick, it is which system it connects to and with what permissions. A separate user for the agent, with least privilege and no access to delete or cancel operations, rules out most of these scenarios. If a system cannot restrict permissions at that level, that is a good reason not to plug an agent into it.
The second is human approval before anything irreversible. An agent that prepares a draft and waits for a click keeps the time saving and drops the risk. The simple rule is that every AI feature produces a suggestion waiting for approval, and never writes a document or an expense by itself.
The third is an activity log. After an incident like this you need to know what was done, when, and to which customer. Without a record, even repairing the damage is hard.
Before the next agent goes near a system in your business, ask two questions: which actions here cannot be undone, and who approves them before they happen.