Front Gate Tickets is a company most business operators have never heard of, and that invisibility is part of the problem. It handles ticketing for nearly every major US music festival except Coachella. Lollapalooza, Bonnaroo, South by Southwest, Austin City Limits, Electric Daisy Carnival: all of them run through Front Gate. The company is a subsidiary of Live Nation Entertainment, the same parent that owns Ticketmaster, which a federal jury found guilty of holding an illegal monopoly in the ticketing market just this past April.
Security researcher Ian Carroll became curious about Front Gate after noticing it appeared on festival after festival's ticketing page. He decided to look for security weaknesses in its website. He quickly spotted what the security world calls a SQL injection vulnerability: a flaw that lets an attacker type commands into an input field on a website, causing the site's database to run those commands. A firewall on Front Gate's site was supposed to block this, but Carroll asked Claude to find a way around it.
Claude immediately wrote working code that bypassed the firewall. Carroll later said it was the first time he had encountered a technique he did not fully understand until he went back and read what the AI had produced. Claude had found that wrapping one database command inside another would slip past the firewall's detection. From there, it wrote a script that pulled sample data from 500 exposed customer databases.
The access did not stop at customer data. With staff account information exposed, Carroll searched for an administrator account, clicked "reset password," and found that the reset code the site had sent to the administrator's email was sitting in the company's own backend, readable to anyone who had already gotten this far. He used it to set a new password and take over the account. Within minutes he was looking at $4,000 VIP tickets for Bonnaroo and could add as many as he wanted to a cart, for any event, with no restrictions.
Front Gate patched the flaw within 24 hours of being told about it and says there is no evidence anyone exploited it before Carroll. Carroll notes the company cannot confirm it was never exploited, only that they have no evidence of it. He also points out that even without this specific flaw, the system had no two-factor authentication: anyone who knew a staff member's password could log in and issue tickets freely.
The broader point here is not about music festivals. SQL injection, the type of attack at the heart of this story, has been listed as a top-three web application vulnerability for nearly two decades. The fix is well understood. Yet it keeps appearing. A similar flaw hit the US Treasury Department indirectly in early 2025. AI is now making these long-known weaknesses faster to find: where a skilled human researcher might spend days probing a site, an AI tool can identify and exploit a flaw in minutes, and can do so for someone who does not fully understand the technique.
Anthropix runs a program called the Cyber Verification Program that allows approved security researchers to use Claude for this kind of work. Carroll was a member. Anthropic has said that if he had not been approved, his use of Claude in this way would have been detected and blocked. That is a meaningful guardrail, but it only applies to Claude. Other AI tools exist, some with fewer restrictions.
For any organization running a website that accepts user input, handles bookings, stores customer records, or processes transactions, the practical takeaway is direct. The cost of a basic security audit, done by a human or now increasingly by AI tools available to defenders, is far lower than the cost of a breach. The Front Gate story is a friendly version of what this looks like when it goes wrong. The next version may not be friendly.