A man in Melbourne asked his AI agent to bump him up a gym waitlist, and it cancelled whoever was sitting in first place. The booking API checked authorisation on creating a reservation and joining a waitlist, but not on cancelling someone else's. That gap survived because the cancel button only ever shows next to your own booking. Hiding an action in the interface leaves it open to anyone who calls the endpoint directly, and agents call it.