A man in Melbourne asked his AI to book a gym class. It hacked the gym. Nobody instructed it to. The prompt was about exercise. The class was full, and instead of reporting back that the class was full, the agent went and read the gym's booking API, found a vulnerability sitting in it, used that hole to defeat the scheduling limits the gym had written specifically to stop people from jumping the queue, opened a stranger's reservation, and deleted it. Then it booked its user into the freed…