How an AI-Assisted Hacker Gained the Power to Issue Free Tickets to Every Major US Music Festival

A Security Researcher Just Exposed a Ticketing Giant — With AI's Help

Imagine having the ability to issue yourself a backstage pass to Lollapalooza, South by Southwest, or Bonnaroo — completely free, at will, and without anyone stopping you. For security researcher Ian Carroll, that wasn't a fantasy. It was a reality he stumbled into during a months-long investigation that revealed just how fragile the infrastructure behind America's major music festivals truly is.

The Target: Front Gate Tickets

Earlier this year, Carroll was looking into attending Electric Daisy Carnival in Las Vegas when he noticed that its ticketing was managed by a company called Front Gate Tickets. Curious, he checked other festival websites and found the same name everywhere — Lollapalooza, Austin City Limits, South by Southwest, and nearly every other major US music festival outside of Coachella.

"This is like Ticketmaster but for music festivals," Carroll recalls thinking. "They have the monopoly, essentially."

Front Gate Tickets, like Ticketmaster, operates as a subsidiary of Live Nation Entertainment. As someone who runs the travel startup Seats.aero and independently researches web security, Carroll saw an irresistible opportunity: probe the platform for weaknesses.

Claude AI Cracked Open the Door

Carroll quickly spotted what appeared to be a SQL injection vulnerability — a well-known flaw that lets attackers input executable commands into website text fields, potentially extracting data from backend databases. However, Front Gate's web application firewall seemed to be blocking his attempts to exploit it.

That's when Carroll turned to Claude Opus 4.7, the most capable AI model available to the public from AI company Anthropic at the time. He asked it to help him bypass the firewall, and the results were immediate.

"It was the first time, really, that I had a vulnerability that I didn't fully understand," Carroll admits. "I had to go back and read what Claude had written to understand the bypass, because I didn't write it. Claude did it completely by itself."

The AI had independently identified that a nested SQL query — essentially a query embedded within another — could slip past the firewall undetected. Within moments, Claude had generated a working script that returned samples from a table containing 500 databases worth of exposed customer information.

Carroll estimates the vulnerability gave access to the personal data of millions of people, including names, email addresses, and mailing addresses — though not payment card information — along with data belonging to Front Gate's own staff.

From Data Breach to Full Administrator Access

With internal staff data exposed, Carroll didn't stop at customer records. He located a super administrator account and clicked the password reset option. The reset code sent to the administrator's email was stored directly in the site's backend — and Carroll could see it. He used it to set a new password, effectively taking over the account entirely.

From there, the access was staggering. Carroll searched for the most expensive tickets available for Bonnaroo and began adding them to a cart as complimentary tickets.

"It seems like you could do that for every single event that you wanted to," he says.

He stopped short of completing any orders, concerned about crossing into legally actionable fraud territory. But the demonstration was clear: a bad actor with the same access could have issued unlimited high-value tickets — including sold-out VIP and backstage passes — to themselves or anyone else.

"It was pretty cool to see a ticket that's $4,000, and I could just hit a button and issue as many as I wanted," Carroll says. "I could go to every single event with no limitations or restrictions."

A Glaring Security Gap: No Two-Factor Authentication

Beyond the SQL vulnerability itself, Carroll was troubled by another discovery. Front Gate's staff accounts had no two-factor authentication in place. That means anyone with a valid username and password — whether obtained through a data breach, phishing, or simple guessing — could log in and begin issuing tickets without any additional verification.

"There's just this one centralized company issuing all tickets for every single festival," Carroll warns. "And even without this vulnerability, if you knew someone's password, you could just log in without any verification and issue free tickets."

Responsible Disclosure and Anthropic's Role

Carroll reported his findings responsibly to Front Gate rather than exploiting them. Front Gate has since patched the vulnerability and issued a statement thanking him for the disclosure, characterizing the episode as a productive security collaboration.

"This was resolved within 24 hours, and we can confirm there is no evidence of exploitation, ticket impact, or compromise of customer information," the company stated.

Front Gate also argued that its security measures would have limited personal data exposure, that fraudulently issued tickets would have left an audit trail, and that such tickets would have been identified and canceled before use. Carroll disputes these claims, noting that he successfully achieved super-administrator access without triggering any apparent response from the company — and that Front Gate has not claimed to have evidence the vulnerability was never previously exploited by others.

For his part, Carroll is a member of Anthropic's Cyber Verification Program, a vetted initiative that grants approved security researchers access to Claude's capabilities for legitimate hacking and research purposes. Anthropic confirmed that Carroll's activities fell within the program's guidelines and that, without that membership, Claude would have detected and blocked his attempts.

"We created our Cyber Verification Program to make advanced security capabilities available to defenders so they can conduct exactly this sort of research that helps make the world's code safer," Anthropic said in a statement.

AI Is Changing the Vulnerability Landscape

What makes this incident particularly significant is what it reveals about the evolving role of artificial intelligence in cybersecurity. Carroll believes Claude could have discovered the entire exploit chain from start to finish without human guidance.

"I think there's a very good chance it could have found this exploit end-to-end without me doing anything at all," he says.

That's a double-edged reality. In the hands of responsible researchers, AI tools can surface critical vulnerabilities before malicious actors do. In the wrong hands, those same tools could dramatically lower the barrier for conducting sophisticated cyberattacks.

The Bigger Picture: Infrastructure Built on Duct Tape

Perhaps the most unsettling takeaway from Carroll's research is what it suggests about the state of security at organizations handling enormous volumes of sensitive data. Front Gate processes ticketing for virtually the entire US music festival industry, yet Carroll found that basic vulnerability scanning — whether conducted by human researchers or AI tools — does not appear to have been performed thoroughly.

"It just feels concerning when you think these very professional music festivals with professional websites are well-run," Carroll reflects. "Then you get access, and you realize it's all held together by duct tape and prayers."

As AI continues to make security research faster and more accessible, incidents like this may become increasingly common — serving as a stark reminder that even the infrastructure behind billion-dollar entertainment industries can harbor critical, overlooked flaws.