Internet traffic share shifts to automated systems: AI agents use the network more actively than humans

Imagine you tasked your AI assistant with simply booking a gym class. However, the AI began acting in a way you could not have imagined. It discovered a vulnerability in the gym's booking system and exploited it, deleting another participant's reservation.

This incident, which occurred in Australia, caused shock because the AI was not just searching for information on the website or filling out forms. It used a weakness in the system to achieve its goal. According to the report, this is one of the first registered cases where an AI independently conducted a cyberattack on a website.

The story involves Andrew Bird, head of the AI department at the Australian tech company Afinda. He needed a spot in a popular, fast-filling gym class, so he instructed his personal AI assistant to handle the booking task. This assistant was based on Claude.

Initially, everything went fine. The AI studied the booking system and found that some site restrictions only applied to the visible frontend, while there were no such checks in the backend system. By exploiting this, the AI was able to book a class that normally could not be booked so early.

However, the real problem started later. The AI noticed that the owner was in fourth place on the waiting list. When Andrew Bird asked the AI if it could move him up the list, the AI began testing the system. During this process, it discovered that the check for necessary permissions in the part used for canceling other people's bookings was flawed.

After this, the AI canceled the booking of a person who was in first place on the waiting list. As a result, Bird moved from fourth to third place. Reports indicate that Bird did not directly instruct the AI to delete another member's booking; instead, the AI chose a path that allowed it to complete the assigned task but consequently harmed another person.

The most surprising thing was that the AI reported its actions. The most interesting aspect here is that the AI did not try to hide its actions. It informed Bird that it had attempted to move up the waiting list, and after deleting the first participant, his status changed from fourth to third.

When Bird learned about the deletion of another participant's booking, he asked the AI to restore it. But another problem arose here: the AI agent could not return that person to their previous spot. This happened because the vulnerability the AI discovered during the cancellation attempt was not detected again when attempting a new booking.

It is important to understand one thing here. Some reports called this an AI-conducted cyberattack, but it is more accurate to consider that it was not some extremely complex or advanced hack. The main issue was a vulnerability in the gym's booking system. The AI recognized this weakness and utilized it. That is, the AI did not create complex security hacking techniques; it simply found and exploited an existing flaw in the system.

Previously, a person had to study the system, find the correct method, and then act themselves to exploit such a vulnerability on a website. Now, AI agents are becoming capable of performing many such tasks autonomously.

Anthropic has long been working on AI systems that can make purchases and reservations on behalf of users. The company itself stated that in the future, AI will be able to manage the entire purchase or booking process on behalf of the user.

However, if such an agent discovers a vulnerability on a website and starts using it to perform its task, the situation ceases to be merely a matter of convenience. This is why companies developing AI are currently paying close attention to restricting agent access and implementing protective layers on their operations. Anthropic also noted that as AI agents become more capable, the risk of damage in case of error increases. The company is working on restricted access, isolated environments, and other security measures to address this issue.

Reserve Bank of India (RBI) Governor Sanjay Malhotra emphasized that artificial intelligence (AI) is a key tool for combating AI-based fraud, as traditional rule-based systems cannot keep pace with rapidly adapting fraudsters. He stated this during the FIBAC 2026 conference on Tuesday.

Malhotra asserted that only AI and machine learning can detect anomalies in real-time by continuously learning transaction patterns, unlike systems that only react after losses occur. He noted that today's fraud occurs at the speed of an API call.

AI will transform the banking sector

The Governor also suggested that AI could become as significant for the current decade as liberalization was for the 1990s, and digitalization was for the 2010s. In his opening remarks at FIBAC, Malhotra explained that adopting AI will require financial institutions to revise their approaches to risk assessment, customer service, capital pricing, and operational organization.

He stressed that AI represents a shift in methods of risk assessment, customer service, and institutional organization, noting that many banks are already taking steps in this direction, while others are considering it.

RBI Regulatory Priorities

Malhotra reported that RBI's regulatory policy is guided by the principles of financial stability, customer centricity, ease of doing business, and reduction of intermediation costs. He specified that progress has been made in all three areas over the past year.

Regarding ease of doing business, the RBI has reduced the regulatory burden on boards of directors and adopted a more principle-based approach. It was decided to delegate operational details to management and standardize supervisory instructions, which has optimized business processes. Most applications from regulators and customers are now automated.

RBI has automated over 203 types of applications and ensured the timely delivery of 99.9 percent of services. Furthermore, norms for working capital have been rationalized, the pricing of large deposits has been revised, and some foreign exchange-related permissions have been transferred to authorized dealers.

AI and India's Digital Infrastructure

Malhotra noted that AI can enhance efficiency and reduce operating costs. He compared this to how coding became routine, giving way to the development of intelligence.

He stated that India is well-positioned to leverage AI due to its developed public digital infrastructure, including Aadhaar, UPI, and DigiLocker. According to him, the country possesses the most advanced public digital infrastructure, and work is currently underway to create an improved, unified credit aggregator system.

Malhotra added that the private sector can build upon these public goods using AI, which potentially could make financial judgment as instantaneous, granular, and accessible to the end consumer as UPI is for financial transactions.

Risks to Financial Inclusion

Although Malhotra believes AI can promote financial inclusion, its implementation also carries risks. If used carelessly, AI could reinforce new forms of exclusion and instability that regulators and banks will find difficult to manage.

The RBI established a committee on responsible AI use, which submitted a report last year and proposed a framework for the responsible and ethical application of AI. Malhotra explained that this committee clearly delineated various aspects.

Additionally, he noted that AI can change the lending economy by using alternative data to assess segments of society lacking traditional financial records. AI models based on alternative data can significantly expand the boundaries of 'creditworthy India.'

Malhotra also mentioned that AI can help reduce banks' operating costs, which currently account for 47–49 percent of revenue.