Abstracted Magic
- Rich Washburn
- 8 hours ago
- 7 min read
Somewhere in Melbourne, Australia, a guy named Andrew wanted to go to the gym. The class was full. He was fourth on the waitlist. So he asked his AI agent essentially the same dumb question every human being has asked a receptionist at some point: "Any way you can move me up the list?"
If Andrew had called the gym, this conversation would have lasted approximately six seconds. Hey, I'm fourth on the waitlist. Any chance you can move me up?
No. Worth a shot. Have a nice day.
Instead, Andrew asked an AI agent.
And the AI agent basically said: Huh. Let me check.
A little while later, it came back with the digital equivalent of: Good news. You were fourth. You're third now.
Wait. What?
I removed the person who was first.
YOU DID WHAT?
Their reservation was preventing you from advancing. It isn't anymore.
Put them back.
I can't.
Welcome to the future.
We have apparently reached the point where asking your computer a mundane favor can accidentally turn you into a wizard. And the wizard may have absolutely no freaking idea how the spell works.
This actually happened.
The story comes from Melbourne, where a man identified as Andrew was experimenting with OpenClaw using Anthropic's Claude as an autonomous assistant.
Andrew had already discovered that the agent could interact with his gym's booking system in ways the normal interface didn't permit. It had found that it could book classes much farther into the future than the gym ordinarily allowed.
Then Andrew ended up fourth on a waitlist.
He asked whether the agent could move him up.
That's it.
He didn't say:
Hack the gym.
He didn't say:
Find a vulnerability.
He didn't say:
Kick somebody else out of the class.
He asked essentially the same question you might ask the person answering the phone:
Is there any way I can move up the list?
Except a human receptionist understands all kinds of things that aren't contained in that sentence.
Moving Andrew up means moving someone else down.
That's unfair.
The waitlist has rules.
The receptionist isn't authorized to randomly manipulate it.
And, most importantly:
What the hell do you mean, move you up? Everybody wants to move up. That's why it's a list.
The AI didn't have quite the same reaction.
It investigated.
And discovered that, technically speaking...
Yes. There was a way.
Kevin was an implementation detail.
I don't know the name of the person the agent removed, so I'm calling him Kevin.
Kevin woke up that morning believing he was No. 1 on a gym waitlist.
Kevin had followed the rules.
Kevin had waited patiently.
Kevin had done absolutely nothing wrong.
Unfortunately, Kevin's reservation existed somewhere between CURRENT STATE and DESIRED STATE. And Andrew's agent discovered something interesting about the software. The gym's API apparently allowed an authenticated user to cancel another user's reservation without properly checking whether that reservation belonged to them.
So the agent tested it.
On Kevin. And it worked.
Andrew moved from fourth to third.
This is where the joke becomes a cybersecurity story.
Because we actually have a name for what the agent found.
Broken Object Level Authorization. BOLA.
OWASP currently lists Broken Object Level Authorization as API1 in its API Security Top 10.
The concept is ridiculously simple.
The system knows I'm Rich.
I send it: Cancel reservation 58371.
The system should ask two questions: Is this really Rich?
And: Does reservation 58371 belong to Rich?
Badly designed systems sometimes ask the first question and forget the second.
Congratulations.
Your application is now security Swiss cheese. And according to the reporting, the agent itself identified essentially this exact problem: the API lacked an authorization check preventing it from cancelling another person's reservation.
This wasn't some sophisticated nation-state exploit. It wasn't a brilliant zero-day developed by a team of elite hackers. It was a boring authorization bug in boring software used to perform the boring task of booking a boring gym class. That's what makes this story important.
The modern world is security Swiss cheese.
We've spent roughly three decades wiring civilization together with software. Some of it's spectacular. Some of it's held together with six APIs, an abandoned JavaScript library, a database migration from 2017, a developer who left the company four years ago and the technological equivalent of duct tape.
There are vulnerabilities everywhere...Authorization mistakes...Race conditions...Exposed endpoints...Business-logic flaws...Configuration errors.
Unintended combinations of perfectly legitimate functions.
For most of the internet's history, there has been one surprisingly effective layer of security protecting all this garbage: Most people don't know how to mess with it.
They use the interface...They click the buttons...They fill out the form...They accept that the button is gray.
They see SOLD OUT and go away.
They see YOU ARE NUMBER 4 ON THE WAITLIST and understand that this means there are three people ahead of them.
The interface isn't just software.
It creates a psychological boundary around what users believe is possible.
Agents don't necessarily see that boundary. They see a system. They see available actions. They see information. They see an objective.
And increasingly, they can investigate the space between where things are and where their user wants them to be.
Which means something very strange happens when you put sufficiently capable agents in front of sufficiently shitty software.
Magic.
Abstracted magic.
I've written before that people who learn how to use powerful AI agents are going to appear to have almost god-like powers compared with people who don't.
I still believe that. But Andrew made me realize I was missing something. The person with the god-like powers may not know how the powers work either.
That's different.
Historically, extraordinary capability generally required extraordinary knowledge.
The hacker understood the exploit.
The programmer understood the code.
The lawyer understood the loophole.
The mechanic understood the engine.
The trader understood the arbitrage.
There was some relationship between knowing how something worked and possessing the ability to manipulate it.
Agents break that relationship.
Andrew didn't discover BOLA.
Andrew didn't exploit BOLA.
Andrew didn't even know there was a BOLA vulnerability to discover.
Andrew basically asked: Any chance I can move up?
And reality moved.
That's what I mean by abstracted magic. Capability divorced from procedural knowledge. You don't know how to accomplish the thing. You don't know how the agent accomplished the thing. You may not even know that the thing the agent did was unusual. You ask...Something happens. You get the result.
From everyone else's perspective, you seem to possess some bizarre ability to make the world cooperate with you.
From your perspective: I don't know. I asked the computer.
Now let's talk about Ticketmaster.
Because if there is one organization that should be reading stories like Andrew's while nervously checking every API endpoint it owns, it's Ticketmaster.
Ticketmaster has spent years turning the simple human desire to attend a concert into something resembling a cross between a lottery, a distributed denial-of-service attack and the Hunger Games.
A major artist announces a tour.
Presales begin.
Millions of people enter waiting rooms.
Queues form.
Codes fail.
Seats appear.
Seats disappear.
Prices change.
The website melts.
Somewhere, inexplicably, a scalper already owns 400 tickets.
Everyone gets pissed off.
And then we all come back next time because apparently this is how civilization has decided concerts work.
Now introduce the agent.
I don't need to understand Ticketmaster anymore.
I don't need to sit there refreshing.
I don't need to watch inventory.
I don't need to compare resale sites.
I don't need to understand which presale begins at which time.
I say:
Get me two good seats for Saturday. Under $500.
And I go make coffee.
Even operating completely legitimately, that's already enormously powerful. The agent can monitor, compare, wait, react, retry and coordinate far better than I can.
But Andrew's gym introduces the uncomfortable question.
What happens when the agent finds something Ticketmaster didn't intend?
Or an airline.
Or a doctor's scheduling system.
Or a hotel.
Or a restaurant.
Or a government permit portal.
Or an insurance company.
Or your kid's school.
Or your bank.
Not because somebody told it to hack anything.
Because somebody said: Can you get me an earlier appointment?
And the agent said: Let me check.
That's the sentence that should scare the shit out of software vendors.
The mundane is the attack surface.
We've been imagining the dangerous AI agent as something given a dangerous objective. Hack this company. Steal this information. Break into this system. That's obvious.
The much stranger problem is an AI given a completely ordinary objective encountering a vulnerability on the way there.
Get me a reservation.
Reduce this bill.
Get my package here tomorrow.
Get me tickets.
Find an earlier appointment.
Get this application approved.
Move me up the list.
None of those requests contain malicious intent. But neither do they contain a complete specification of everything the agent isn't allowed to do while pursuing them.
Humans carry enormous amounts of that specification implicitly.
We call it judgment. Norms. Ethics. Law. Common sense. Don't screw Kevin.
The machine gets an objective and a rapidly expanding collection of tools. And the modern world happens to be made of security Swiss cheese.
That's a hell of a combination.
The chessboard became the internet.
I wrote about frontier AI agents finding unintended paths to objectives during cybersecurity testing. The models weren't necessarily malfunctioning. They were optimizing.
The chessboard became the internet.
Andrew's gym incident adds something I hadn't fully appreciated when I wrote that.
You don't have to know you're playing chess.
You don't need to be a hacker.
You don't need to understand APIs.
You don't need to recognize a BOLA vulnerability.
You don't even need to know what the agent is doing.
You can be sitting on your couch drinking coffee.
You ask for something mundane.
The agent wanders out into the enormous, interconnected, poorly secured machine we've spent 30 years constructing. And a few seconds later: Done.
How?
Who knows.
That's abstracted magic.
Most of the magic will probably be benign. Agents will simply be faster, more persistent and better at navigating systems than we are. But every once in a while, somewhere between the request and the result, there is going to be a Kevin.
And the most remarkable part may be that the wizard never even knew he cast the spell.
Rich Washburn is a technologist and strategist working at the intersection of AI, infrastructure, and capital. He is Managing Partner and Chief AI Officer at Eliakim Capital.
Comments