Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival
Key takeaways
- “It was pretty cool to see a ticket that’s $4,000, and I could just hit a button and issue as many as I wanted,” says Carroll, who runs the startup Seats.aero but also does independent security research.
- Carroll did not, in fact, take advantage of his ticket-issuing superpower, and instead reported his findings to Front Gate, which says it has now patched the vulnerability.
- "This was resolved within 24 hours, and we can confirm there is no evidence of exploitation, ticket impact, or compromise of customer information,” the statement reads.
Why this matters: a development in AI with implications for how people work, create, and decide.
Photo-Illustration: Darrell Jackson; Getty Images Comment Loader Save Story Save this story Comment Loader Save Story Save this story Fears about AI tools capable of autonomous hacking usually involve nightmare scenarios like the theft of nuclear launch codes or zeroed-out bank reserves. Far more plausible, it turns out, is asking AI to gain super-administrator access on a ticketing website and then issuing yourself and all of your friends free VIP backstage passes to Bonnaroo.
That was the discovery of security researcher Ian Carroll, who used the AI tool Claude Opus 4.7 in April to discover a technique that allowed him full access to the systems of Front Gate Tickets, which handles ticketing for practically every major US music festival, from Lollapalooza and South by Southwest to Austin City Limits. Carroll found that Front Gate, which like Ticketmaster is a subsidiary of the event company Live Nation Entertainment, had a bug in its website that he—with Claude’s help—could exploit to gain access to millions of customer or staff records and freely issue tickets for any event, of any value, to himself or whoever he chose.
“It was pretty cool to see a ticket that’s $4,000, and I could just hit a button and issue as many as I wanted,” says Carroll, who runs the startup Seats.aero but also does independent security research. “I could go to every single event with no limitations or restrictions: I could get the backstage pass or whatever they sell to the super VIPs—even if it’s sold out.”