Security researcher Ian Carroll used Claude Opus 4.7 to break into Front Gate Tickets, the Live Nation Entertainment subsidiary that runs ticketing for nearly every major US music festival, and gained the ability to issue unlimited $4,000 VIP passes to Lollapalooza, Bonnaroo, South by Southwest, and Austin City Limits. The vulnerability exposed 500 databases containing information on millions of customers and staff. Front Gate says it patched the flaw within 24 hours after Carroll disclosed it, and reports no evidence the bug was previously exploited.
Carroll, who runs the flight-search startup Seats.aero and does independent security work, first probed Front Gate's site after noticing the company handled ticketing for every major US festival other than Coachella, including the Electric Daisy Carnival in his hometown of Las Vegas. He found what looked like a SQL injection flaw but was initially blocked by a web application firewall. He then handed the problem to Opus 4.7, the most advanced model Anthropic had made publicly available at the time, through Anthropic's Cyber Verification Program.
“It was pretty cool to see a ticket that's $4,000, and I could just hit a button and issue as many as I wanted.”— Ian Carroll, Security researcher and founder of Seats.aero
The model wrote the bypass on its own. Claude constructed a nested SQL query — a query inside another query — that evaded firewall detection, then generated a script that pulled samples from 500 databases of exposed customer records. Carroll says the payload gave access to names, emails, and mailing addresses of millions of Front Gate customers, along with staff data. Payment card details were not exposed.
Key facts
- 01Security researcher Ian Carroll used Anthropic's Claude Opus 4.7 to breach Front Gate Tickets, the Live Nation subsidiary handling Lollapalooza, Bonnaroo, SXSW, and Austin City Limits.
- 02Claude wrote a nested SQL query that bypassed Front Gate's web application firewall, exposing 500 databases of customer information covering millions of records.
- 03Carroll gained super-administrator access and could issue $4,000 VIP tickets at will; Front Gate says it patched the flaw within 24 hours.
- 04Carroll accessed the site through Anthropic's Cyber Verification Program, which whitelists approved researchers for offensive security work.
- 05Front Gate had no two-factor authentication on administrator accounts, meaning a leaked password alone could unlock ticket issuance across every festival on its platform.
From the staff data, Carroll pivoted to full account takeover. He located a super-administrator account, triggered a password reset, retrieved the reset code from the site's own backend, and set a new password. Once logged in as an administrator, he added Bonnaroo Platinum tickets to a comp-ticket cart. He stopped short of completing an order, citing fraud exposure, but says the same workflow would have worked for every event on the platform.
Carroll's own reaction is the most telling part of the story. He needed to read Claude's output to understand what the model had done, a shift from the traditional research workflow where the human writes the exploit and the tool assists. He estimates Claude could have completed the entire attack chain end to end without his intervention.
Front Gate disputes some of Carroll's framing. In its statement, the company said the flaw was in an internal API used by entry scanners at festival venues rather than a consumer login portal, and that fraudulent tickets would have left an audit trail and been canceled before use. Carroll counters that he reached super-administrator privileges without any visible response from Front Gate's security team, and that the company has not claimed evidence the vulnerability wasn't exploited before he found it.
The company's public statement thanked Carroll and framed the incident as a successful researcher collaboration.
“This was resolved within 24 hours, and we can confirm there is no evidence of exploitation, ticket impact, or compromise of customer information.”— Front Gate Tickets, Company statement
Anthropic said the Cyber Verification Program exists specifically to give defenders access to advanced offensive tooling, and told WIRED that Carroll's activity would have been detected and blocked had he not been an approved participant. That guardrail is the load-bearing element of the whole story: without the program, the same capability sits behind Anthropic's standard safety filters, which are supposed to refuse this class of request.
The Front Gate flaw itself is straightforward — a SQL injection filtered by a WAF, with no two-factor authentication on administrator accounts. Carroll's point is that the ticketing monopoly's security posture was so thin that a password leak alone would have handed an attacker the same access, no AI required. The AI angle is that Claude collapsed the time and expertise needed to find and weaponize the bug from days of expert work to a single prompt.
The skeptical read is that Carroll is a trained web-application researcher who identified the injection point himself and knew what to ask for. Claude accelerated the exploit; it didn't originate the hunt. Front Gate's argument that damage would have been contained by audit logs and ticket revocation is also not disprovable in the abstract, and no customer data appears to have been taken. The 24-hour patch is genuinely fast for an enterprise ticketing platform.
What this incident does clarify is the shape of the near-term AI security market. Frontier models are now capable enough that firewall-bypass generation and multi-stage account takeover fall inside a single research session, and the meaningful control point has moved from the model's refusal behavior to programs like Anthropic's Cyber Verification, which decide who gets to point the capability at production systems. For Live Nation subsidiaries and every other operator running consumer platforms held together by, in Carroll's phrase, duct tape and prayers, the calculus has changed: the marginal attacker just got a co-pilot, and the defender's grace period for unpatched injection flaws is measured in prompts, not quarters.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
