An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.

Summary: Reflectiz's AI pentesting agent, mapping the login flow of a major insurer's production website with millions of users, requested a login code and directed it to an email inbox it controlled; the code arrived and the login went through, and its guardrails halted the test after the login succeeded. The flaw was that the login request carried two fields deciding delivery channel and address, and the server sent the code to whatever address the request named rather than the one registered to the account, with no check that the address belonged to the account.
Why it matters: The insurer said it had pentested the site about six months earlier, and the weakness was still there - a point-in-time test schedule does not move when the site changes with every release, while attackers using AI to find flaws do not wait for the next test window.

Read the original at The Hacker News ↗