VulnerabilitiesAI pentesting agent finds OTP bypass on insurer's live site
A report published on 14 October 2026 says the agent worked unaided during an authorised assessment, and that proving the flaw was harder than exploiting it.
14 Oct 2026
AI Pentesting Agent Finds Critical OTP Bypass at Major Insurer
During an authorized security assessment, an AI pentesting agent discovered a critical authentication bypass on a major insurer's production website, where a login request allowed an attacker to choose where the one-time passcode (OTP) was sent.
Disclosed 14 October 2026 · Record updated 14 October 2026
Impact
A login flow vulnerability allowed selection of the OTP delivery destination, enabling a potential authentication bypass on a major insurer's live production website.
Our coverage
VulnerabilitiesSources
- thehackernews.comhttps://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html