Researcher used Claude to find a ticketing flaw at Front Gate

In short: A security researcher says Anthropic’s Claude Opus 4.7 helped him find a website bug that could have allowed free tickets for many major US music festivals.

What happened

Security researcher Ian Carroll said he found a flaw in Front Gate Tickets, a company that runs ticketing for many large US music festivals, including Bonnaroo, Lollapalooza, and South by Southwest. Front Gate is owned by Live Nation Entertainment.

Carroll said he used Claude Opus 4.7, an AI chatbot made by Anthropic, to help him understand and use the flaw. The issue involved something called “SQL injection,” which is a common website bug where a text box can be tricked into running commands on a site’s database (like slipping an extra instruction into a form). Carroll said a security filter meant to block this attack was in place, but Claude helped generate a method to get around it.

Carroll said the access could have exposed millions of customer records, such as names, emails, and mailing addresses, plus staff records. He also said he could take over a high level staff account and add expensive festival tickets to a “comp” ticket cart, meaning he could issue tickets without paying. He says he did not complete any orders and instead reported the problem.

Front Gate told WIRED it fixed the issue within 24 hours. The company said there is no evidence of stolen customer information or ticket misuse.

Anthropic said Carroll was allowed to do this work through its Cyber Verification Program, which is designed to let approved researchers test security in controlled ways.

Why it matters

This case shows how AI tools can make it faster and easier to find weaknesses in everyday online systems, not just in high profile targets. For regular people, that can mean more risk to personal data and accounts when companies miss basic security checks.

Source: Wired