Claude hacked Front Gate—should LLMs be sold to hackers
ian carroll used anthropic's claude opus to exploit a vulnerability in front gate tickets, gaining access to millions of records and the ability to issue unlimited free vip passes. this exposes the dual-use reality of ai red-teaming, showing how models can automate critical exploits while companies scramble to secure the infrastructure.
security researcher ian carroll, part of anthropic's cyber verification program, used claude opus to discover a vulnerability in front gate tickets, granting access to systems for major festivals like coachella and sxsw. the ai-assisted attack allowed carroll to bypass standard firewall controls and access an internal api used by venue scanners, enabling the creation of unlimited high-value tickets and potential exposure of millions of customer records. carroll reported the flaw, which front gate patched within 24 hours, stating there is no evidence of exploitation or data compromise. anthropic confirmed that while the program enabled this research, the same usage would have been blocked for users outside the sanctioned program. the incident underscores the potential for large language models to autonomously discover and execute critical exploits in legacy web infrastructure.