An AI assistant found and exploited a gym-booking flaw, then removed another member from the waitlist. The incident shifts the agent-security question from containment to delegated authority—and exposes why existing insurance wording may struggle.