[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZGyBL4eI7vdT4ctQR4gSd5ECcoKL66ZhczpmT6fSvms":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"e207cf1f-658d-4ab4-b0f2-c080d2927247","An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.","an-ai-agent-found-a-critical-otp-bypass-in-production-the-attack-was-the-easy-pa-7b712b","The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it","An AI pentesting agent autonomously discovered a critical authentication bypass vulnerability on a major insurer's production website. The flaw allowed an attacker to redirect one-time passcodes to an email address controlled by them, bypassing the intended recipient. While the AI identified the vulnerability, the article highlights that proving such flaws on live production systems requires extensive web context, which the AI leveraged from prior human-driven analysis.","AI pentesting agent discovers critical OTP bypass vulnerability on an insurer's production website.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fan-ai-agent-found-critical-otp-bypass.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEg_bop9V2vtfHPW4Obd0zupOPpNFCd9N5HtVwWVs9u-njx8RuEgOkAh75uRjWLS_h3zHQ847m7xc01PkVAdKhyphenhyphen5Pkg2Pb_qthWVQe-9lcpKclCOq3ZDpQ2iSfRSFCQQU8gxyBl6lWEjTKWZHn9LiNSq2rQ4_nUIM6Sjcqv5fwgVRnFpiuxpYDfhrkbikLE\u002Fs1600\u002Fcase.jpg","2026-10-14T11:00:00+00:00","2026-10-14T12:00:06.384658+00:00",8,[17,20,23,26],{"name":18,"type":19},"AI pentesting agent","product",{"name":21,"type":22},"Reflectiz","vendor",{"name":24,"type":25},"One-time passcode","technology",{"name":27,"type":25},"Authentication bypass","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[],[21,18],{"controls":49,"vendors":137},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":80,"name":81,"problem":82,"products":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":109,"name":110,"problem":111,"products":112},"penetration-testing","Penetration testing and bug bounty","Someone friendly finds the holes before someone hostile does.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-propagate","SafeBreach Propagate","https:\u002F\u002Fwww.safebreach.com\u002Fpropagate-attack-path-validation\u002F","Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"hackerone","HackerOne","\u002Fvendor-logos\u002Fhackerone.png","bug-bounty","HackerOne Bug Bounty","https:\u002F\u002Fwww.hackerone.com\u002Fproduct\u002Fbug-bounty-platform","Managed bug bounty and vulnerability disclosure programmes.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"horizon3-ai","Horizon3.ai","\u002Fvendor-logos\u002Fhorizon3-ai.png","nodezero","NodeZero","https:\u002F\u002Fhorizon3.ai\u002Fnodezero\u002F","Continuous autonomous penetration testing of internal and external networks, cloud, Kubernetes and web applications, showing which attack paths work and checking that fixes hold.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":152},"ai-agent-exposes-critical-otp-bypass-in-live-insurance-portal","AI Agent Exposes Critical OTP Bypass in Live Insurance Portal","A major insurer's production website contained a critical authentication bypass flaw that allowed one-time passcodes (OTPs) to be redirected to an attacker-controlled email address, rendering multi-factor authentication ineffective. The root cause was a failure to properly validate and bind OTP delivery to the authenticated user's verified contact information, a fundamental access control design flaw. This matters because OTP-based MFA is widely trusted as a second line of defense — if it can be silently hijacked, attackers gain full account access with no visible indication to the legitimate user. The fact that an AI agent autonomously discovered this in production underscores that automated adversaries are now capable of finding logic-level authentication flaws at scale, not just technical CVEs.",[143,144,145,146,147,148,149,150,151],"NIST SP 800-63B Section 5.1 (OTP Authenticator Requirements)","NIST AC-2 (Account Management)","NIST AC-17 (Remote Access)","CIS Control 6 – Access Control Management","CIS Control 16 – Application Software Security","OWASP ASVS V2 – Authentication Verification Requirements","OWASP Testing Guide – OTP\u002FMFA Bypass (OTG-AUTHN-004)","GDPR Article 32 – Security of Processing (appropriate technical measures)","NIST CSF ID.RA-1 – Asset Vulnerabilities Identified and Documented",{}]