An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.

A major insurer's production website contained a critical authentication bypass flaw that allowed one-time passcodes (OTPs) to be redirected to an attacker-controlled email address, rendering multi-factor authentication ineffective. The root cause was a failure to properly validate and bind OTP delivery to the authenticated user's verified contact information, a fundamental access control design flaw. This matters because OTP-based MFA is widely trusted as a second line of defense — if it can be silently hijacked, attackers gain full account access with no visible indication to the legitimate user. The fact that an AI agent autonomously discovered this in production underscores that automated adversaries are now capable of finding logic-level authentication flaws at scale, not just technical CVEs.