LAS VEGAS — Security researcher Ian Carroll used the AI tool Claude Opus 4.7 in April to gain full administrative access to the systems of Front Gate Tickets. This access, achieved through a SQL injection vulnerability, exposed potential risks to millions of customer or staff records and the ability to issue tickets for any event.

Carroll reported his findings to Front Gate Tickets, which stated that it resolved the vulnerability within 24 hours. Front Gate Tickets also stated that there is no evidence of exploitation, ticket impact, or compromise of customer information. A statement from the company indicated that the issue was identified by a security researcher using AI-assisted tools to bypass standard firewall security controls and access an internal API used by entry scanners at festival venues.

Carroll identified a SQL injection vulnerability on the Front Gate website that a web application firewall initially blocked. He then asked Claude Opus 4.7 to find a way to exploit this vulnerability. The AI model generated a hacking technique using a nested SQL query that bypassed the firewall's detection.

The AI tool wrote a script that displayed samples from a table of 500 databases containing exposed customer information. Carroll successfully gained super-administrator privileges on the Front Gate platform without any discernible response from the company. He then used accessed staff data to take over a super administrator's account by resetting the password using a code found in the site's backend. Carroll noted that no two-factor authentication prevented access to the administrator account after the password reset.

After gaining administrator access, Carroll added expensive Bonnaroo tickets to a shopping cart as comp tickets. "It was pretty cool to see a ticket that's $4,000, and I could just hit a button and issue as many as I wanted," Carroll said. He did not complete an order or issue any tickets to avoid being charged with fraud. Carroll believes the vulnerability would have provided access to the information of millions of customers, including names, emails, and mailing addresses, but not credit card details.

Front Gate Tickets is a subsidiary of Live Nation Entertainment and handles ticketing for events such as Lollapalooza, South by Southwest, and Austin City Limits. Front Gate Tickets confirmed Carroll's findings after he shared a draft of a blog post about his discovery with the company. Carroll is part of Anthropic's Cyber Verification Program, which Anthropic created to make advanced security capabilities available to defenders. Anthropic stated that if Carroll had not been part of the program, his use of Claude to access Front Gate's systems would have been detected and blocked.