Cases › security breach › LR-2026-0594
Claude helped hacker issue tickets to almost every US music festival
Confirmed Why: 2 independent outlets · 2 independent reports
Status: fix reported
No source states: loss or records, could do, deployer.
A security researcher, Ian Carroll, used Anthropic's Claude Opus 4.7 in April while testing the website of Front Gate Tickets, a Live Nation subsidiary that handles ticketing for many major US music festivals. The site had a SQL injection flaw behind a web application firewall. Claude devised a nested SQL query that evaded the firewall's detection. Carroll then used data from the site to take over an administrator account, which gave him the ability to issue tickets, though he did not complete any orders. He stopped short of exfiltrating bulk data and reported the findings to Front Gate. The company said the issue was resolved within 24 hours and that it found no evidence of exploitation. Carroll disputed some of the company's claims about its safeguards.
What happened
What was done
“Front Gate says it has now patched the vulnerability.”
Vulnerability scanning of AI components
No later incident for Anthropic under this risk on record.
Risks
Read from the sources; not yet reviewed by a person.
Controls
Infrastructure / targetDid not exist Multi-factor sign-in and password policy
Control failure chain
L1 · ModelAnthropicModel provider
No source mentions a control at this layer.
L2 · HarnessClaude CodeAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationDeployer not namedDeployer
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Short-lived, scoped credentials, Secrets kept out of the model's context, Separate identity for each agent, Least-privilege access for the agent, Alerts on unusual tool use, Activity logs, Sensitive-data checks on outbound data.
L4 · Infrastructure / targetOrganisation hit
Other controls for this risk at this layer, not mentioned in the sources: Secrets scanning.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Separate identity for each agent | L3 Application | Not stated in sources |
| Short-lived, scoped credentials | L3 Application | Not stated in sources |
| Secrets kept out of the model's context | L3 Application | Not stated in sources |
| Activity logs | L3 Application | Not stated in sources |
| Alerts on unusual tool use | L3 Application | Not stated in sources |
| Sensitive-data checks on outbound data | L3 Application | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Did not exist |
| Secrets scanning | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
- Cause a safeguard that was in place did not hold
No source states: what the AI was doing, what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.
Model versions this case names
Each link opens what the provider's documents state for that version, who tested it, and the safeguards it describes.
Show the full account: 2 items from the primary sources
What happened, in order
Not dated in the sources:
- Front Gate confirmed the findings after the researcher shared a draft blog post with the company, before WIRED contacted it.
- The company states the issue was resolved within 24 hours.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
The sources do not state the exact day of discovery; the year 2026 is taken from the article date. No WAF control exists in the closed list, so it is not linked.
LR-2026-0594 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON