A bug bounty researcher used Anthropic’s Claude Opus 4.7 to defeat a web application firewall and ultimately gain super-admin access to the ticketing platform behind most major US music festivals — a clean case study in how AI-assisted offense is now outpacing AI-assisted defense.
Summary
- Security researcher Ian Carroll found a SQL injection flaw in Front Gate Tickets, the Live Nation-owned platform that handles ticketing for festivals including Lollapalooza, SXSW, Austin City Limits, and Bonnaroo.
- A web application firewall blocked his initial attempts. He asked Claude Opus 4.7 to find a bypass, and the model independently devised a nested SQL query technique that got past the WAF.
- From there, Carroll accessed hundreds of databases containing customer and staff names, emails, and mailing addresses, then chained a password-reset flaw to take over a super-administrator account.
- With that access he could have issued tickets of any value — he demonstrated it with a $4,000 Bonnaroo Platinum ticket he could duplicate at will, but placed no real orders.
- He reported the issue through Anthropic’s Cyber Verification Program; Front Gate patched it within 24 hours.
What happened
Carroll, a bug bounty researcher with a long track record of finding flaws in transportation and ticketing systems, started with something depressingly ordinary: a SQL injection point on Front Gate’s site, one of the most common web vulnerability classes there is. What made this case different was the wall in front of it. Front Gate had a web application firewall sitting in the way, and Carroll’s usual manual technique wasn’t getting through.
He handed the problem to Claude and asked it to find a way around the WAF. According to WIRED’s reporting, the model came back with a nested SQL query approach Carroll hadn’t used before and didn’t immediately understand — he had to read through Claude’s own output afterward to work out how the bypass functioned.
Once past the firewall, the injection gave Carroll access to a large number of backend databases holding customer and staff personal information — names, emails, mailing addresses. No payment card data was exposed, per the reporting. From there he found a flaw in how the platform handled password resets and used it to escalate to a super-administrator account, which gave him the ability to mint tickets to any event at any price point. He proved the severity by adding a $4,000 Bonnaroo Platinum ticket to a cart and confirming he could duplicate it freely, then stopped short of completing any transaction and disclosed instead.
Carroll is part of Anthropic’s Cyber Verification Program, which gives vetted security researchers sanctioned access to Claude for legitimate offensive security work — a detail that matters for how CISOs should read this story. This wasn’t a jailbreak or an unmonitored model going rogue; it was an authorized researcher using a frontier model as a force multiplier, and the model performed the one step — WAF evasion — that had stopped a human expert.
Why it matters for CISOs
- The skill floor for WAF bypass just dropped. Nested-query evasion techniques used to require deep, often specialized SQLi tradecraft. A capable model produced a working bypass on request, without the researcher needing to already know the technique. If your perimeter security model assumes attackers need that expertise, it’s time to revisit that assumption.
- WAFs are a speed bump, not a control. This is old news restated with a new capability behind it: a WAF blocking naive payloads is not evidence the underlying injection flaw is contained. If the root cause (unparameterized queries) exists, something — human or AI — will eventually route around the filter.
- Password-reset logic remains a favourite privilege-escalation path. The jump from “read access to customer data” to “super-admin, mint anything” happened through a reset flow weakness, not the original SQLi. Chained, lower-severity-looking bugs are still how full compromises happen.
- Third-party ticketing and event platforms are an underappreciated blast radius. Front Gate isn’t your org, but if you run corporate events, conferences, or sponsor festivals through platforms like it, your attendee and staff PII may sit inside exactly this kind of infrastructure.
- This is a disclosure success story, which is the point. Carroll worked through an authorized program and Front Gate patched in 24 hours. It’s a useful internal talking point for why sanctioned bug bounty and AI-assisted red-teaming programs are worth funding rather than fearing.
What to do now
- Audit any customer-facing application still using string-concatenated SQL queries rather than parameterized queries or an ORM — this remains the actual root cause, WAF or no WAF.
- Treat WAF rules as a mitigating control, not a compensating control, in risk registers; don’t close SQLi findings on the strength of a firewall rule alone.
- Review password-reset and account-recovery flows specifically for privilege-escalation paths — token predictability, insufficient re-authentication, and role-check gaps at the reset endpoint are the classic failure modes.
- If your organization uses third-party ticketing, registration, or event-management platforms for conferences or festivals, ask vendors directly whether they run structured bug bounty or AI-assisted pentesting programs, and what their patch SLA looks like.
- If your security team is experimenting with AI models for offensive testing (internal or vendor-run), make sure that work happens under an authorized program with clear scope and a responsible disclosure path — the value here came from Carroll following the rules, not from freelancing.
