An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.

An AI pentesting agent from Reflectiz autonomously found a critical authentication bypass in a major insurer’s production website, The Hacker News reports. The login flow let an attacker choose where a one-time passcode was delivered, so the code could be sent to an attacker-controlled email address instead of the account holder’s phone.