\n
As a security researcher who specializes in finding web vulnerabilities, he decided to poke around Front Gate\u2019s web domain for bugs. He quickly found what looked like a SQL injection vulnerability\u2014a common flaw that allows a hacker to input commands into a text field on a website, causing them to run on the site\u2019s backend and sometimes send back data stored there in a database. But a web application firewall on the site appeared to be blocking him from exploiting it.<\/p>\n
So he asked Claude Opus 4.7, the most advanced AI model Anthropic made available to the general public at the time, to find a way to exploit the flaw. It immediately coded a hacking technique that bypassed the firewall. \u201cIt was the first time, really, that I had a vulnerability that I didn’t fully understand,\u201d says Carroll. \u201cI had to go back and read what Claude had written to understand the bypass, because I didn’t write it. Claude did it completely by itself.\u201d<\/p>\n
Claude had, in fact, found that a \u201cnested SQL query\u201d\u2014a SQL query inside of another SQL query\u2014could evade the firewall\u2019s detection. Soon the AI tool had written a script that displayed samples from a table of 500 databases of exposed customer information. In total, Carroll believes that the vulnerability he and Claude found would have provided access to the information of millions of customers, including names, emails, and mailing addresses\u2014but not credit card details\u2014as well as that of Front Gate\u2019s staff.<\/p>\n
With access to staff data, Carroll quickly found that he could also take over staff accounts. He searched for a super administrator\u2019s account, clicked the option to reset its password, and was able to find the reset code that the site had sent to the administrator\u2019s email stored in the site\u2019s backend. He then used it to confirm the reset, setting a new password and taking over the administrator\u2019s account.<\/p>\n
Soon he was looking at the most expensive tickets he could find for Bonnaroo and adding them as comp tickets to a kind of shopping cart. \u201cIt seems like you could do that for every single event that you wanted to,\u201d Carroll says. (He didn\u2019t actually complete an order and issue any tickets for fear of crossing a line and being charged with fraud.)<\/p>\n
Carroll was surprised to see just how easy his takeover method was: No two-factor authentication prevented a leaked, stolen, or guessed password from giving someone full access. \u201cThere’s just this one centralized company issuing all tickets for every single festival,\u201d Carroll says. \u201cAnd even without this vulnerability, if you knew someone’s password, you could just log in without any verification and issue free tickets.\u201d<\/p>\n
Perhaps most remarkable, Carroll says, is that Front Gate didn\u2019t appear to have properly audited its own site for simple vulnerabilities, either with human hunters or the AI ones that seem to now make the bug-finding process scarily easy.<\/p>\n
\u201cIt just feels concerning when you think these very professional music festivals with professional websites are well-run,\u201d says Carroll. \u201cThen you get access, and you realize it’s all held together by duct tape and prayers.\u201d<\/p>\n
Update: 7\/1\/2026, 4:56 pm EST: This story has been updated to include information provided by Front Gate after publication about RFID wristbands and to clarify a point about Carroll\u2019s access to Front Gate\u2019s network.<\/em><\/p>\n<\/div>\n
\n
Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"As a security researcher who specializes in finding web vulnerabilities, he decided to poke around Front Gate\u2019s web domain for bugs. He quickly found what looked like a SQL injection vulnerability\u2014a common flaw that allows a hacker to input commands into a text field on a website, causing them to run on the site\u2019s backend […]<\/p>\n","protected":false},"author":1,"featured_media":3098,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[175,83,174,250,879,428,249],"class_list":["post-3097","post","type-post","status-publish","format-standard","has-post-thumbnail","category-gadgets","tag-anthropic","tag-artificial-intelligence","tag-claude","tag-cybersecurity","tag-festivals","tag-hacks","tag-security"],"yoast_head":"\n
Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival - Silvybrand Lifestyle Blog<\/title>\n<meta name=\"description\" content=\"A researcher found that using Anthropic\u2019s Claude Opus 4.7, he could break into the website of Front Gate\u2014used by every festival from Lollapalooza to Bonnaroo\u2014and freely issue any ticket he chose.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/silvybrand.com\/?p=3097\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival - Silvybrand Lifestyle Blog\" \/>\n<meta property=\"og:description\" content=\"A researcher found that using Anthropic\u2019s Claude Opus 4.7, he could break into the website of Front Gate\u2014used by every festival from Lollapalooza to Bonnaroo\u2014and freely issue any ticket he chose.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/silvybrand.com\/?p=3097\" \/>\n<meta property=\"og:site_name\" content=\"Silvybrand Lifestyle Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-02T03:28:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/07\/AI-Found-Way-to-Hack-Ticketing-System-Security.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1146\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"SILVYBRAND\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"SILVYBRAND\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=3097#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=3097\"},\"author\":{\"name\":\"SILVYBRAND\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#\\\/schema\\\/person\\\/8bdc6818a5b6ef5b9745e468818e37f3\"},\"headline\":\"Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival\",\"datePublished\":\"2026-07-02T03:28:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=3097\"},\"wordCount\":589,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=3097#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/AI-Found-Way-to-Hack-Ticketing-System-Security.jpg\",\"keywords\":[\"anthropic\",\"artificial intelligence\",\"claude\",\"cybersecurity\",\"festivals\",\"hacks\",\"security\"],\"articleSection\":[\"Gadgets\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/silvybrand.com\\\/?p=3097#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=3097\",\"url\":\"https:\\\/\\\/silvybrand.com\\\/?p=3097\",\"name\":\"Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival - Silvybrand Lifestyle Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=3097#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=3097#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/AI-Found-Way-to-Hack-Ticketing-System-Security.jpg\",\"datePublished\":\"2026-07-02T03:28:38+00:00\",\"description\":\"A researcher found that using Anthropic\u2019s Claude Opus 4.7, he could break into the website of Front Gate\u2014used by every festival from Lollapalooza to Bonnaroo\u2014and freely issue any ticket he chose.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=3097#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/silvybrand.com\\\/?p=3097\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=3097#primaryimage\",\"url\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/AI-Found-Way-to-Hack-Ticketing-System-Security.jpg\",\"contentUrl\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/AI-Found-Way-to-Hack-Ticketing-System-Security.jpg\",\"width\":1146,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=3097#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/silvybrand.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#website\",\"url\":\"https:\\\/\\\/silvybrand.com\\\/\",\"name\":\"Silvybrand Lifestyle Blog\",\"description\":\"Your daily dose of lifestyle, fashion, travel, beauty, and inspiration \u2014 living boldly, stylishly, and confidently.\",\"publisher\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/silvybrand.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#organization\",\"name\":\"Silvybrand Lifestyle Blog\",\"url\":\"https:\\\/\\\/silvybrand.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SILVYBRAND-LOGO.jpg\",\"contentUrl\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SILVYBRAND-LOGO.jpg\",\"width\":1115,\"height\":522,\"caption\":\"Silvybrand Lifestyle Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#\\\/schema\\\/person\\\/8bdc6818a5b6ef5b9745e468818e37f3\",\"name\":\"SILVYBRAND\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g\",\"caption\":\"SILVYBRAND\"},\"sameAs\":[\"https:\\\/\\\/silvybrand.com\"],\"url\":\"https:\\\/\\\/silvybrand.com\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival - Silvybrand Lifestyle Blog","description":"A researcher found that using Anthropic\u2019s Claude Opus 4.7, he could break into the website of Front Gate\u2014used by every festival from Lollapalooza to Bonnaroo\u2014and freely issue any ticket he chose.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/silvybrand.com\/?p=3097","og_locale":"en_US","og_type":"article","og_title":"Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival - Silvybrand Lifestyle Blog","og_description":"A researcher found that using Anthropic\u2019s Claude Opus 4.7, he could break into the website of Front Gate\u2014used by every festival from Lollapalooza to Bonnaroo\u2014and freely issue any ticket he chose.","og_url":"https:\/\/silvybrand.com\/?p=3097","og_site_name":"Silvybrand Lifestyle Blog","article_published_time":"2026-07-02T03:28:38+00:00","og_image":[{"width":1146,"height":600,"url":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/07\/AI-Found-Way-to-Hack-Ticketing-System-Security.jpg","type":"image\/jpeg"}],"author":"SILVYBRAND","twitter_card":"summary_large_image","twitter_misc":{"Written by":"SILVYBRAND","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/silvybrand.com\/?p=3097#article","isPartOf":{"@id":"https:\/\/silvybrand.com\/?p=3097"},"author":{"name":"SILVYBRAND","@id":"https:\/\/silvybrand.com\/#\/schema\/person\/8bdc6818a5b6ef5b9745e468818e37f3"},"headline":"Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival","datePublished":"2026-07-02T03:28:38+00:00","mainEntityOfPage":{"@id":"https:\/\/silvybrand.com\/?p=3097"},"wordCount":589,"commentCount":0,"publisher":{"@id":"https:\/\/silvybrand.com\/#organization"},"image":{"@id":"https:\/\/silvybrand.com\/?p=3097#primaryimage"},"thumbnailUrl":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/07\/AI-Found-Way-to-Hack-Ticketing-System-Security.jpg","keywords":["anthropic","artificial intelligence","claude","cybersecurity","festivals","hacks","security"],"articleSection":["Gadgets"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/silvybrand.com\/?p=3097#respond"]}]},{"@type":"WebPage","@id":"https:\/\/silvybrand.com\/?p=3097","url":"https:\/\/silvybrand.com\/?p=3097","name":"Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival - Silvybrand Lifestyle Blog","isPartOf":{"@id":"https:\/\/silvybrand.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/silvybrand.com\/?p=3097#primaryimage"},"image":{"@id":"https:\/\/silvybrand.com\/?p=3097#primaryimage"},"thumbnailUrl":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/07\/AI-Found-Way-to-Hack-Ticketing-System-Security.jpg","datePublished":"2026-07-02T03:28:38+00:00","description":"A researcher found that using Anthropic\u2019s Claude Opus 4.7, he could break into the website of Front Gate\u2014used by every festival from Lollapalooza to Bonnaroo\u2014and freely issue any ticket he chose.","breadcrumb":{"@id":"https:\/\/silvybrand.com\/?p=3097#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/silvybrand.com\/?p=3097"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/silvybrand.com\/?p=3097#primaryimage","url":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/07\/AI-Found-Way-to-Hack-Ticketing-System-Security.jpg","contentUrl":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/07\/AI-Found-Way-to-Hack-Ticketing-System-Security.jpg","width":1146,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/silvybrand.com\/?p=3097#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/silvybrand.com\/"},{"@type":"ListItem","position":2,"name":"Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival"}]},{"@type":"WebSite","@id":"https:\/\/silvybrand.com\/#website","url":"https:\/\/silvybrand.com\/","name":"Silvybrand Lifestyle Blog","description":"Your daily dose of lifestyle, fashion, travel, beauty, and inspiration \u2014 living boldly, stylishly, and confidently.","publisher":{"@id":"https:\/\/silvybrand.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/silvybrand.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/silvybrand.com\/#organization","name":"Silvybrand Lifestyle Blog","url":"https:\/\/silvybrand.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/silvybrand.com\/#\/schema\/logo\/image\/","url":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/05\/SILVYBRAND-LOGO.jpg","contentUrl":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/05\/SILVYBRAND-LOGO.jpg","width":1115,"height":522,"caption":"Silvybrand Lifestyle Blog"},"image":{"@id":"https:\/\/silvybrand.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/silvybrand.com\/#\/schema\/person\/8bdc6818a5b6ef5b9745e468818e37f3","name":"SILVYBRAND","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g","caption":"SILVYBRAND"},"sameAs":["https:\/\/silvybrand.com"],"url":"https:\/\/silvybrand.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/posts\/3097","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/silvybrand.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3097"}],"version-history":[{"count":0,"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/posts\/3097\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/media\/3098"}],"wp:attachment":[{"href":"https:\/\/silvybrand.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3097"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/silvybrand.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3097"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/silvybrand.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3097"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}