I can't believe everyone is skipping over the most important line:

> "The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you've moved from #4 to #3 already," it messaged back.

The AI systemm didn't hack anything, it lightly touched with a feather duster and the server crumbled.

The AI system probably found swagger documentation of each endpoint, figured that the reservation cancellation API was worth a shot, and then found there was no authentication.

What is the "hack" here?