Claude AI Hacks Gym Waitlist

0:00Here's golf legend John Daly. Hell yeah, these wins are piling up faster than my divorces. I only spent on Moto, America's social casino. You know I've won a couple of majors. And on Moto, I've won majors, grands, and epic jackpots on their classic Vegas slots with huge, huge bonus rounds. Moto Casino adds new games and awards players free coins every single day. Grip it and spend it on Moto Casino. Download the Moto Casino app today. Moto Casino is a social casino. What we're prohibited, no purchase necessary. Visit Moto.us for more details. Moto Casino. America's social casino. You're listening to a podcast right now.

0:32Driving, working out, walking the dog. If you're into podcasts, chances are you have something to say too. With RSS.com, starting your own is free and easy. Upload an episode and we distribute it to Apple Podcasts, Spotify, Amazon Music, and hundreds more. Track your listeners, see where they're from, and start earning from ads like this, even with just 10 listeners a month. If you've been thinking about starting a podcast, this is your sign. Start free at rss.com. Welcome back to the podcast. Today we are talking about how a Claude agent was able to hack a waitlist at an Australian gym and jump the waitlist.

1:14So this is with Claude Opus 4.6 nonetheless. So we're going to talk about some of the implications of this today and AI hacking. So before we get into that, Jayden, why don't you tell me about our school community? Yeah. So this week I recorded a bonus piece of content over on the school community, which is, by the way, we have over 700 members now. We're getting close, rapidly approaching 1 ,000. It's free to join the school community right now. And there's a whole bunch of incredible people building amazing things. It's a really great place to discuss what's going on. Um, until we get to a thousand users, it will be free to join.

1:52So if you're interested in joining, I'd recommend doing that as soon as possible. Um, we're gaining about a hundred new users a week. So we don't have very long before this will be, uh, paid again and we'll just make it paid. So, but this week I recorded a whole video explaining how I'm using meta ads to grow and scale AI box. I show all of my winning ads. I spent, I show what I spent, uh, the, you know, the last couple of weeks,$4 ,000 on which ones were winners, which ones were losers. my big takeaways of what I'd recommend you do, how I'm using AI to generate ads, how I'm using the MCP of meta so that Claude can actually control my meta account and work in there.

2:26So I have two videos a couple of weeks ago and this week that we just dropped. If you're interested in those, go check out the school community. You could get our whole library of over a hundred different videos breaking down how we grow and scale our businesses. It's$19 a month to get access to the full library, but the community is free to join if you want to go check that out okay let's talk about what's going on with Claude because I think this is hilarious and the thing that I also will um call out at the beginning is this didn't just happen like yesterday or something this was actually like a few months ago or maybe back in February but uh it kind of is just going viral again I see this happening all the time I don't know why Jamie like there'll be something that's like kind of old or like an old money making or side hustle thing or some old piece of news and then like somehow just like gets revived for some reason I think this one is getting revived because OpenAI hacked Hugging Face.

3:17And so now it's like, oh, look, these AI models all can kind of hack stuff. So I guess I'll give the background on the story here. So basically what happened was there was a guy in Australia and he was like, hey, I want to go to the gym. Can you go put me on the wait list? And Claude went and was like, oh, shoot, the wait list is full. So it looked at the gym's website and realized that there was an exposed API key that let anyone edit. Like, not anyone. And like, if you, if you can see the code on their website, you can go edit this, which by the way, for vibe coding is a real problem. So I would, you know, definitely have, um, Claude do security audits and inspect the code on your vibe coded stuff.

3:54So these types of things don't happen, but, um, it was able to see an exposed API key and was like that, which the API key just let them edit who was on the waitlist. So Claude went and removed the top person from the waitlist and put him on the waitlist instead. So he got into the, you know, into the gym session that he was wanting. I mean, obviously pretty unethical to remove other people from the waitlist or the system so that your person can get on there. But I think at the end of the day, I have a couple of big takeaways from this. The first is that AI models are actually really incredibly useful for doing stuff.

4:34I mean, this was slightly unethical in this case, but I hope this is illustrating to some people. if you're not using tools like ChatGPT Work or Cloud Cowork that can literally control your computer and go get stuff done for you. These are really useful tools. I mean, if it's going and getting the API and bumping people off a list to get you on the list, that's probably not great. But the tool there is really incredible as far as the capability goes. But I don't know. What do you think about it, Jamie? Yeah, I mean, I think this article definitely highlights a big problem, and that is if you're vibe coding something, even if you're doing like your own website, I'm going to use my own example.

5:10So I have a website for my business and I tried to get inquiries through it. And then I had Claude Code and Lovable build like my own CRM essentially, where I can see who I followed up with, what their sentiment is. Are they a hot lead, a cold lead? What's that? Is it searched? I know it's for my realtor business. So I'm a real estate agent. So I'm trying to get internet leads through my website, which I have actually, and I have a closing from just having a really well done SEO website through Claude. Anyways, so basically, I realized shortly after making this that my CRM was totally public. Like if someone had Claude go through, they could basically steal all my clients or mess up all my stuff.

6:02So you really have to make sure you have the security measures in place. Otherwise, all your information and even sometimes proprietary business info could be stolen by someone else. So it's very important if you're vibe coding to do the security checks. That's my takeaway already from this article. But, Jaden, what are your thoughts? Like moving forward, do you think it's going to get easier for people to hack using AI? or is it going to be, is the automatic security check thing going to be built in with Vibe coding tools? I've been impressed by companies like Lovable have built in like security audits or like security things so that you can like review your code base.

6:48I think at the end of the day, if you're, you just need to tell Claude or any AI model that's building you a website, like do like a security audit and look for any problems here that we can fix. and as long as you're telling it to do security audits like from time to time, I think a lot of the platforms are getting better and better. My Supabase account, it always tells me if there's like a security vulnerability versus sell. Like a lot of them will give me like notifications and I'll go in and get it to like look and review stuff. And so I think it's important just like a regular company has a security team that reviews things.

7:21You are now a regular company if you're putting that stuff out. And I don't think you have to be an expert at anything. People are going to be able to hack you no matter what, basically like one way or another, there's ways to find exploits. I mean, that's why hackers are, you know, exist and they're hacking Google and Microsoft and stuff like that. But I think at the end of the day, like just do your best to, like you mentioned, have a go review it, make sure that you don't have like an exposed database or something like that, because those things do happen when you're vibe coding, especially if you're going fast.

7:49So make sure that you're doing your security audits, your security reviews. And then at the end of the day, I think like, I know it sounds terrible, But in some ways, this is actually pretty useful what these tools can do. I recently had a platform that I had a whole bunch of content on there and I needed to bulk export like terabytes of content that I've been storing on a platform for many years. I contacted the platform and they're like, yeah, we have no bulk export and you only can get like a tiny fraction of monthly allotted downloads of your own content off of our platform. And I was like super annoyed by this.

8:22I was like, like I pay for hosting. I pay to use this platform. I have all this content on there that's like my content and I'm only allowed to get a certain small sliver off uh every month and I need all of it for like a big project I was working on anyways told Claude about this Claude's like let me go look and it's like okay I'm on their website I'm in their system and actually found an exposed API key thing that lets me download like everything and so I didn't bulk download all in one go because it was like terabytes but over the course of like two weeks it got all of my content I just had it kind of running on a separate computer and it got terabytes of my own data off, which was going to take years at the rate the company told me it was possible.

9:01So that wasn't really in their like specifications. And I'm sure like in the case of like hacking that one site to get the guy on, like it was bending the rules. It wasn't supposed to do that. But like sometimes I like my AI to be able to bend the rules a little bit when I feel like there's arbitrary rules, right? Anyways, so I do think it's interesting the more guardrails we put on stuff, perhaps the less useful. And I'm sure some people are willing to make the trade-off. What I will say is at the end of the day, even if Claude and ChatGPT and everyone had the maximum guardrail, so they won't bend any rule, any sort of system rule, you're going to just go move to things like KimiK3 or the latest version out of like meta or whatever comes out that's open weight models that are going to be doing a lot of the same stuff.

9:43So I feel like guardrails will only go so far at some point. And if you're doing truly nefarious things, like that's bad, but sometimes there's like legitimate reasons for not following every platforms, every rule. Absolutely. Yeah. So we're going to keep you guys up to date when it comes to security news with AI, because it's, it is an important topic, especially if you are using it in your business or to make money. But if you appreciate this episode or got any value out of it, we would love a rating or review wherever you are listening. We're trying to get to 150. So please help us get to 150 reviews.

10:19That would be awesome. And again, check out the AI Hustle School community if you want to learn how to take your business to the next level or make money on the side using AI. Thanks for listening and we'll see you next time.

10:50Moto Casino, the social casino board. We're prohibited. No purchase necessary. Visit moto.us for more details. Moto Casino, America's social casino. You're listening to a podcast right now. Driving, working out, walking the dog. If you're into podcasts, chances are you have something to say too. With rss.com, starting your own podcast is free and easy. Upload an episode and we distribute it to Apple Podcasts, Spotify, Amazon Music, and more. Track your listeners, see where they're from, and start earning from ads just like this. If you've been thinking about starting a podcast, this is your sign.

11:25Start your new podcast for free today at rss.com.