Hacker uses Claude to get super-admin access and free VIP tickets to top US festivals
When tech giants tell us their AI is locked down and harmless, we nod and wait for someone to use it to bypass firewalls. This time, Claude became the ultimate festival gatecrasher, proving that the road to digital security is paved with hilarious corporate oversights.
Security researcher Ian Carroll pointed his browser at Front Gate Tickets, the platform owned by Live Nation that handles ticketing for massive events like Lollapalooza and Bonnaroo. He spotted a potential SQL injection vulnerability, but a stubborn web application firewall stood in his way, blocking his manual attempts.
Instead of spending hours crafting a bypass, he turned to Claude, asking the AI to find a way around the digital bouncer. The AI obliged, writing a clever nested SQL query that slipped past the firewall undetected—leaving the researcher himself scratching his head trying to understand how the AI's code actually worked.
With the firewall bypassed, the security researcher obtained super-administrator access to the entire ticketing database. He requested a password reset for an admin account and simply fetched the verification code directly from the backend database, completely bypassing the non-existent two-factor authentication.
This access allowed him to generate any ticket for free, including a $4,000 VIP pass to Bonnaroo, which he added to his cart but refrained from checking out to avoid fraud charges. The exploit also exposed the personal data of millions of customers, including names, email addresses, and physical mail destinations.
Upon receiving the report, the ticket distributor patched the issue within 24 hours. The company downplayed the severity, claiming the breach only exposed an internal ticket-scanning API rather than the public site, a claim the researcher strongly disputes since he logged in directly through the public portal.
While Anthropic noted that this bypass was only possible because the researcher had special unrestricted developer access, the incident highlights how rapidly AI is democratizing high-level hacking. In a world where multi-billion-dollar entertainment monopolies can't bother to implement basic two-factor authentication for super-admins, perhaps relying on AI guardrails to save the day is the ultimate pipedream.
Source: WIRED
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.