Is it even possible to "hack" an API that has no authorisation for any of its methods?
If you leave your front door open I don’t think you’d classifying someone walking in and taking your laptop as ‘not stealing’.
AI agent hacks gym to get its user a spot in pilates class
11–20 of 75 posts
Re: AI agent hacks gym to get its user a spot in pilates class
#12Is it even possible to "hack" an API that has no authorisation for any of its methods?
Practically speaking, discovering that fact and taking advantage of it, is already "hacking".
Re: AI agent hacks gym to get its user a spot in pilates class
#13Is it even possible to "hack" an API that has no authorisation for any of its methods?
It's being used unintentionally to do things it wasn't designed to do... isn't that hacking by definition? Missing Auth is a typical finding.
Re: AI agent hacks gym to get its user a spot in pilates class
#14Is it even possible to "hack" an API that has no authorisation for any of its methods?
In a legal sense any unwanted intrusion can be considered hacking - i.e. a 'hack' is not contingent on penetrating authorization. In practice most APIs are secured by obscurity rather than any high quality rigorous authorization. The only thing it would make absolutely clear at a legal level is that you do not want the API to be publicly used, but for a jury/judge accessing an unadvertised API via browser tools is hacking.
Re: AI agent hacks gym to get its user a spot in pilates class
#15Old news framed as something fresh. That "happened in April" may as well read "happened 2 years ago" and is like saying someone was caught jay walking.
Re: AI agent hacks gym to get its user a spot in pilates class
#16Guess this will become common now. I used Claude to write a small application to monitor free appointments for driving license renewal at my DMV. Instead of waiting 6 months I was able to get an appointment within a few days.
Re: AI agent hacks gym to get its user a spot in pilates class
#17Is it even possible to "hack" an API that has no authorisation for any of its methods?
If you leave your front door open I don’t think you’d classifying someone walking in and taking your laptop as ‘not stealing’.
However walking through the door would not be a crime in itself, where I live anyway.
Re: AI agent hacks gym to get its user a spot in pilates class
#18Re: AI agent hacks gym to get its user a spot in pilates class
#19Is it even possible to "hack" an API that has no authorisation for any of its methods?
If you ask a software developer: no If you ask a judge: probably yes
In switzerland it depends 143bis StGB:
Any person who, with the intention of securing an unlawful gain for themselves or another obtains for themselves or another data that are stored or transmitted electronically or in some similar manner and which are not intended for them and have been specially secured to prevent their access shall be liable to a custodial sentence not exceeding five years or to a monetary penalty.
Re: AI agent hacks gym to get its user a spot in pilates class
#20Is it even possible to "hack" an API that has no authorisation for any of its methods?
Practically speaking, discovering that fact and taking advantage of it, is already "hacking".
We are used the interfaces being web interfaces.
But say that the underlying api exposes some endpoint discoverability capabilities (eg. Exposing an openAPI spec), then arguably the action was invited: the actions was documented along with the auth model.