The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part.

TL;DR


During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own.
One login request let the user choose where the one-time passcode went.
The attack was the easy part. Proving it



Source: TheHackerNews
Source Link: https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html