AI Tool Helped Researcher Breach Front Gate Tickets System

A security researcher demonstrated how AI-assisted hacking could compromise a major ticketing platform, gaining the ability to issue unlimited passes to nearly every significant music festival in the United States.

Ian Carroll, who runs the startup Seats.aero and conducts independent security research, used Anthropic's Claude Opus 4.7 in April 2026 to discover and exploit a vulnerability in Front Gate Tickets. The platform, a Live Nation Entertainment subsidiary like Ticketmaster, handles ticketing for major festivals including Lollapalooza, South by Southwest, Austin City Limits, and Bonnaroo.

Carroll told WIRED he could have issued thousands of dollars worth of VIP tickets at will. "I could go to every single event with no limitations or restrictions: I could get the backstage pass or whatever they sell to the super VIPs—even if it's sold out," he said.

How the AI-assisted exploit worked

Carroll initially identified what appeared to be a SQL injection vulnerability on Front Gate's website—a common flaw allowing hackers to input commands that execute on backend systems. However, a web application firewall blocked his exploitation attempts.

When he asked Claude Opus 4.7 to find a bypass, the AI immediately coded a technique using nested SQL queries that evaded the firewall's detection. "It was the first time, really, that I had a vulnerability that I didn't fully understand," Carroll said. "I had to go back and read what Claude had written to understand the bypass, because I didn't write it. Claude did it completely by itself."

The vulnerability provided access to approximately 500 databases containing millions of customer records with names, emails, and mailing addresses, plus staff information. Carroll then located a super administrator account, reset its password using a code he found in the backend, and gained full system access—without encountering two-factor authentication.

Why it matters

This incident reveals how AI tools are dramatically lowering the technical barriers to discovering security vulnerabilities across internet infrastructure. Carroll, who participates in Anthropic's Cyber Verification Program allowing approved researchers to use its tools for security testing, believes Claude could have executed the entire exploit autonomously. The ease with which AI identified the bypass technique suggests organizations face an accelerated timeline for identifying and patching vulnerabilities before malicious actors—potentially using similar AI tools—discover them first. The concentration of festival ticketing in a single platform with basic security gaps also highlights systemic risks in consolidated digital infrastructure.

Company response and researcher access

Front Gate confirmed it patched the vulnerability within 24 hours of Carroll's report and stated it found no evidence of prior exploitation or compromised customer information. The company characterized the incident as successful collaboration that improved its security.

Carroll responsibly disclosed his findings without issuing any fraudulent tickets. He is part of Anthropic's program that grants verified security researchers access to advanced AI capabilities for defensive purposes. Anthropic stated that without program membership, Claude's safeguards would have detected and blocked Carroll's hacking attempts.

The researcher expressed concern about the platform's security posture, noting the absence of basic protections like mandatory two-factor authentication for administrator accounts. "It just feels concerning when you think these very professional music festivals with professional websites are well-run," Carroll said. "Then you get access, and you realize it's all held together by duct tape and prayers."

These details were first reported by Andy Greenberg at WIRED.