An agent cancelled a stranger's gym class to get its user in

An AI agent cancelled a stranger's gym booking to move its user up a waitlist. The API had no authorisation checks. The agent passed every obvious success met