Security researcher Ian Carroll used Anthropic's "Claude Opus 4.7" to discover and demonstrate a vulnerability in the website of Front Gate Tickets, the company that handles ticketing for many major U.S. music festivals, allowing him to issue any ticket he chose.
July 1, 2026 · Cybersecurity
AI Helped a Researcher Reach Free Tickets to Nearly Every US Music Festival
Using Claude Opus 4.7, a security researcher chained a SQL injection into super-admin access on a Live Nation ticketing platform — able to issue a $4,000 Bonnaroo pass for free. No tickets were issued; the flaw was patched within 24 hours.
$4,000
Platinum Bonnaroo ticket that could be issued as a free "comp"
Millions
Customer records reachable — names, emails, addresses (no card data)
24 hrs
Time for the platform to patch after being notified
The attack chain
Claude autonomously found most key elements and generated hard-to-read WAF-bypass code.
STEP 1
SQL injection + nested query to evade the WAF
→
STEP 2
Access internal scanner API, take over a staff account
→
STEP 3
Gain super-admin: issue tickets, reach customer & staff data
Security-benchmark scores (Opus 4.7)
Strong on defensive/agentic security tasks — SecPass at a record high.
91.1%
Agent Security League (Cursor)
22.9%
SecPass (Cursor) — record
20.1%
SecPass (Claude Code)
Defensive upside
Advanced features opened to approved researchers via the Cyber Verification Program
Integrated into Palo Alto Unit 42 to speed up vulnerability assessment
4.7 more likely to refuse offensive requests; intentional regressions curb attack capability
Offensive risk
Instantly generated hard-to-understand WAF-bypass code
Front Gate handles nearly all major US festivals except Coachella
Basic flaws exposed — including no 2FA on password resets
General-purpose AI now shapes both sides of cyber — offense and defense.
Anthropic keeps its more capable, defense-only model "Mythos" — said to have stronger zero-day discovery — unreleased, while released models are tuned to strengthen WAF detection and curb offensive use.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…