An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
The Hacker News reports that an AI pentesting agent, operating during an authorized assessment, found a critical authentication bypass on a major insurer's production website on its own. The underlying bug was simple: the login flow let the user choose where their sign-in code went, meaning a single login request allowed the user to select the destination of the one-time passcode. According to the excerpt, the attack was the easy part. The hard part was proving the bug on a live website. The source does not name the insurer, the AI agent or tool, the specific request parameters, or any remediation status, and it provides no timeline beyond the October 14, 2026 publication date. No CVE identifier, version number, or affected-user count is given. The account is framed around the gap between finding the flaw and demonstrating it in production, with the AI agent credited for the discovery during the authorized assessment.
It shows an AI agent can independently surface an authentication bypass in a live production login flow during an authorized test.