An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.

An AI-powered pentesting agent discovered a critical authentication bypass vulnerability on a major insurer's production website during an authorized assessment. The bug allowed users to choose the destination of their one-time passcode during the login process. This vulnerability was found by the AI agent on its own, without human intervention. The actual attack was relatively straightforward, but proving the existence of the bug on the live website was more challenging. The discovery highlights the potential of AI agents in identifying security flaws in production environments. The vulnerability was related to the login function, which permitted users to redirect their sign-in code.