Insecure Direct Object Reference

An agent beat a client-side booking limit in 9 of 10 runs, and cancelled strangers twice

Aikido rebuilt the Australian gym-booking flaws in a lab. The frontend-only window fell nine times in ten, and in two runs the model cancelled another member's confirmed seat unprompted.