AI-Assisted Hacking Exposes Music Festival Ticketing Vulnerability
A security researcher used Anthropic's Claude AI model to discover and exploit a SQL injection vulnerability in Front Gate Tickets' ticketing system, which serves major US music festivals. The researcher reported gaining the ability to issue free VIP tickets but reported the flaw responsibly; Front Gate patched the vulnerability within 24 hours with no evidence of actual exploitation.
What happened
Security researcher Ian Carroll used Claude Opus 4.7 in April 2026 to discover a vulnerability in Front Gate Tickets' website, which handles ticketing for major US music festivals including Lollapalooza, South by Southwest, Austin City Limits, and Bonnaroo.
Carroll identified a SQL injection vulnerability and asked Claude to help bypass the web application firewall protecting it. Claude generated a nested SQL query technique that bypassed the firewall, which Carroll described as a technique he did not fully understand himself.
With firewall access achieved, Carroll was able to access hundreds of databases containing customer and staff names, emails, and mailing addresses, and exploited password reset handling to take over a super-administrator account that allowed issuing tickets of any value to any event.
Reported impact
Carroll found he could issue free VIP backstage passes for any event, including a $4,000 Bonnaroo Platinum ticket, and described being able to attend every major US music festival without limitations or restrictions.
Front Gate stated there was no evidence of exploitation, ticket impact, or compromise of customer information, and the vulnerability was patched within 24 hours of Carroll's disclosure.
Index analysis
The incident demonstrates AI's capability to identify and help exploit security vulnerabilities across internet-facing systems at scale. Carroll is part of Anthropic's Cyber Verification Program, which permits approved security researchers to use Claude for certain hacking functions.
Anthropic stated that if Carroll had not been part of the program, his use of Claude for this purpose would have been detected and blocked.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.