AI helped researcher hack ticketing system for major US music festivals

What happened

Security researcher Ian Carroll used Claude Opus 4.7 in April to discover a vulnerability in Front Gate Tickets, which handles ticketing for nearly every major US music festival including Lollapalooza and South by Southwest. Carroll found he could exploit a SQL injection flaw to gain super-administrator access, allowing him to issue free tickets of any value to himself or others. Front Gate patched the vulnerability within 24 hours after Carroll reported it.

Why it matters

The incident reveals how AI tools can help identify security flaws across the internet at scale. Carroll noted he was surprised Claude came up with key elements of the exploit technique, and he believes there was a very good chance the AI could have found the exploit end-to-end without human involvement. For a company handling ticketing for practically every major US music festival, this concentration of control in a single vendor makes the stakes of such vulnerabilities particularly high.

What to watch

Carroll is part of Anthropic's Cyber Verification Program, which allows approved security researchers to use its AI tools for hacking research; the company stated that if Carroll had not been part of the program, his use of Claude to hack the system would have been detected and blocked. Front Gate confirmed there is no evidence of actual exploitation or compromise of customer information.