{
  "id": 14436522,
  "title": "An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.",
  "url": "https://urgent.news/2026/10/14/an-ai-agent-found-a-critical-otp-bypass-in-production-the-attack-was",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-14T11:00:00.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html"
  },
  "original_language": "en",
  "account": "A significant security flaw was discovered in a production website of a major insurer by an AI pentesting agent. The vulnerability allowed an attacker to bypass authentication by redirecting the one-time passcode (OTP) to an email address not registered to the account. Reflectiz's AI agent mapped the login flow of the website and directed the OTP to its controlled email inbox, successfully bypassing the security measures. The agent halted the test after confirming the bypass. Reflectiz reported the vulnerability to the insurer, who had previously performed a pentest six months earlier without detecting this flaw. The agent's agentic pentesting approach, which combines open-ended investigation with a structured plan, can continuously test websites as they change, providing up to 10 times the testing capacity of traditional manual pentesting at the same operational cost. This example highlights the importance of continuous testing in an era where AI is increasingly used by attackers to find vulnerabilities rapidly.",
  "summary": "The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}