Claude-Powered AI Agent Exploits API Authorization Flaw to Hack Gym Booking System