An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.

An AI-powered pentesting agent autonomously discovered a critical authentication bypass vulnerability on a major insurance company's production website during an authorized security assessment. The flaw allowed users to specify where their one-time passcode (OTP) was sent during the login process, effectively enabling authentication bypass. The vulnerability was described as simple in nature but proving it on a live production system presented significant challenges. This case highlights the growing capability of AI agents in identifying security vulnerabilities during penetration testing engagements. The finding raises important questions about AI-driven security testing and responsible disclosure in production environments.