Breaking

Researcher Uses Claude Opus 4.7 to Find Flaw Allowing Unlimited Front Gate Ticket Issuance

July 5, 2026 at 14:10 EDT

Security
AI Agents

Security researcher Ian Carroll used Anthropic's Claude Opus 4.7 to uncover an SQL injection flaw on the website of Front Gate Tickets—which handles most major US music festivals—that made it possible to issue tickets of any value for any festival without limit. Carroll did not actually issue tickets and reported the issue to Front Gate, which fixed it within 24 hours, WIRED reported.

AI-Assisted Vulnerability · Cyber Verification Program

Claude Opus 4.7 Helped Crack the Platform Behind Most US Music Festivals

A security researcher used Claude to bypass a web firewall and gain super-admin access to Front Gate Tickets — able to issue any ticket for any event. He never issued one, chose responsible disclosure, and the flaw was patched within 24 hours.

Millions

Customer & staff records exposed (names, emails, addresses — no card data)

$4,000

Bonnaroo Platinum-tier ticket, issuable for free without limit

24 hrs

Time to patch after responsible disclosure

How the defense was bypassed

Unauthenticated
SQL injection point

→

Web App Firewall
would normally block it

→

Claude writes a nested
query to bypass WAF

→

Super-admin access
+ record exposure

The researcher said this was the first time Claude wrote the bypass code entirely on its own — he had to read it afterward to understand it — and suggested the AI could likely have made the discovery end to end.

Festivals ticketed by Front Gate

The de facto dominant issuer for most major US festivals other than Coachella.

Lollapalooza Bonnaroo SXSW Austin City Limits Electric Daisy Carnival

A white-hat success story

No fraudulent tickets issued and responsible disclosure followed. Front Gate thanked the researcher; access was via internal APIs, some VIP tickets use RFID wristbands, and alerts, audit logs — plus no evidence of exploitation.

The wider worry

A concrete case of AI finding and exploiting a flaw in a real critical system — the researcher called the site "duct tape and prayers." Outside Anthropic's approved program, such capabilities would likely have been blocked.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.