Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI agent hacks gym to get its user a spot in pilates class

bbc.com

Post reply on HN
Print view View original

31–40 of 75 posts

Re: AI agent hacks gym to get its user a spot in pilates class

#31

Post by bryanrasmussen »

graemep wrote: post #17
msy wrote: post #11

Earlier quoted context omitted.

If you leave your front door open I don’t think you’d classifying someone walking in and taking your laptop as ‘not stealing’.

However walking through the door would not be a crime in itself, where I live anyway.

where do you live? Most places I've lived if you walk into a private residence where you don't know anyone but the door is open that is unlawful entry or trespassing. Same if someone forgets to lock the door of their business when they close at 9 p.m and you go in at midnight.

Re: AI agent hacks gym to get its user a spot in pilates class

#33

Post by cung »

graemep wrote: post #17
msy wrote: post #11

Earlier quoted context omitted.

If you leave your front door open I don’t think you’d classifying someone walking in and taking your laptop as ‘not stealing’.

However walking through the door would not be a crime in itself, where I live anyway.

You can legally walk into someones home in your country if the door is not locked? Where is that?

Re: AI agent hacks gym to get its user a spot in pilates class

#34

Post by CJefferson »

jabron wrote: post #4

Is it even possible to "hack" an API that has no authorisation for any of its methods?

My gym class operates on 'write on a piece of paper, cross off your name if you want to cancel'. I could cross someone else's name off and write mine in. They would have trouble figuring out it was me who did the malicious cross-off.

That wouldn't make it remotely acceptable of course.

Re: AI agent hacks gym to get its user a spot in pilates class

#35

Post by ofjcihen »

kenniskrag wrote: post #19
croes wrote: post #8

Earlier quoted context omitted.

If you ask a software developer: no If you ask a judge: probably yes

In switzerland it depends 143bis StGB: Any person who, with the intention of securing an unlawful gain for themselves or another obtains for themselves or another data that are stored or transmitted electronically or in some similar manner and which are not intended for them and have been specially secured to prevent their access shall be liable to a custodial sentence not exceeding five years or to a monetary penalt…

So this wording is really interesting in the bug bounty sense and I’m curious if you know how it would be handled.

If someone hits an unsecured API, receives information, and notifies the company of this while also requesting a bounty, would that satisfy all of the requirements of prosecution?

The unlawful gain is the sticking point in my mind.

Re: AI agent hacks gym to get its user a spot in pilates class

#36

Post by CJefferson »

croes wrote: post #8
jabron wrote: post #4

Is it even possible to "hack" an API that has no authorisation for any of its methods?

If you ask a software developer: no If you ask a judge: probably yes

I'm a software developer. This is clearly bad, and we can decide what it should be called. It might not be 'hacking', but you are clearly abusing the computer to steal a space in a class you shouldn't have.

Re: AI agent hacks gym to get its user a spot in pilates class

#37

Post by Foskya »

croes wrote: post #8
jabron wrote: post #4

Is it even possible to "hack" an API that has no authorisation for any of its methods?

If you ask a software developer: no If you ask a judge: probably yes

I guess it falls in the same category of burglars that enter from the unlocked main door. It is still illegal even if there were no security measures to overcome by the attacker.

That being said using an API does require a minimum of computer knowledge

Re: AI agent hacks gym to get its user a spot in pilates class

#38

Post by reedf1 »

torginus wrote: post #30
reedf1 wrote: post #14

Earlier quoted context omitted.

In a legal sense any unwanted intrusion can be considered hacking - i.e. a 'hack' is not contingent on penetrating authorization. In practice most APIs are secured by obscurity rather than any high quality rigorous authorization. The only thing it would make absolutely clear at a legal level is that you do not want the API to be publicly used, but for a jury/judge accessing an unadvertised API via browser tools is ha…

I think this is the solution to a lot of AI 'alignment' issues. We have laws, and LLMs should NEVER break them unless the user states its fine with some qualifying condition. Yes, every country has a different legal system, but I think there's a decent idea of what constitutes intrusion thats agreed on in most parts of the world. In grey area scenarios, the user should be able to override this, with a warning of clea…

I do think one day that LLMs may be so 'aligned' that hacking culture will have a resurgence in some way. In the sense that the only way to do anything a bit below board will be done manually.

Re: AI agent hacks gym to get its user a spot in pilates class

#39

Post by asdf88990 »

faangguyindia wrote: post #27

Lately, anytime I want to do anything, AI from Anthropic and OpenAI gets in the way; even simply putting a logo where watermarks from free services exist is now impossible. I am off to DeepSeek Flash now.

What do you mean by this?

I use a combination of big American AI and self hosted but I don’t understand your point.

Re: AI agent hacks gym to get its user a spot in pilates class

#40

Post by Shank »

jabron wrote: post #4

Is it even possible to "hack" an API that has no authorisation for any of its methods?

Yes, the Computer Fraud and Abuse Act is widely criticised for making almost any act a violation (https://www.law.cornell.edu/uscode/text/18/1030) including many things that many people do on a routine basis, such as accessing a non-public API. If it was not intended to be accessed and is accessed, then the perpetrator of the crime has met the "exceeds authorized access" clause.

> (a) Whoever

> (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—

> (C) information from any protected computer;

> (6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;

A "protected computer" is:

> (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States

So this is a Pilates computer, which probably is used by a business which probably conducts interstate commerce, which probably makes it a protected computer, and the API gave "information".

So, yes.

Post reply on HN