An AI Agent Finds an OTP Bypass in Production: The Lesson

There are security findings that can be explained in one sentence and, even so, take weeks of work. That's what happened in an authorized assessment of a major insurer's production website: an artificial intelligence-powered pentesting agent found, without human help, a critical authentication flaw. The error itself was simple. The hard part was proving it was exploitable in a real, live system with real traffic.

What exactly failed

The flaw's mechanism was as simple as it was dangerous: during the login process, the user could choose where the one-time code (OTP) was sent. In other words, the system trusted a decision that shouldn't be in the hands of the person authenticating. If the attacker controls the code's destination, the second factor stops being a factor and becomes a formality.

It's worth pausing here, because this pattern repeats more often than it seems in small and medium-sized business applications:

• The login flow allows parameters the user can manipulate (email, phone, session identifier).
• OTP validation is done against the submitted value, not against the user's legitimate channel.
• There's no check that the code's destination matches the one registered on the account.

The result is a textbook authentication bypass, but with critical impact: access to other people's accounts without needing to break encryption or exploit a memory vulnerability.

The truly hard part: proving it in production

The news insists on a point that at ForgeNEX we consider the most valuable: the attack was the easy part. The costly part was proving the flaw on a production site, with real users, without causing damage or triggering unnecessary alerts. That's where an automated agent adds value: it can explore hypotheses, repeat requests, and document evidence in an orderly way, while the human team decides how far it can go.

This connects to a discussion we've already covered on the blog: AI agents are entering companies faster than the controls to govern them. If an agent can find and exploit a bypass, it can also operate without traceability if no one supervises it. We covered it in AI agents without traceability: the identity hole in your SME, and the insurer case is a perfect example of both sides: useful offensive capability and the need for clear limits.

Why this matters to an SME

It may seem like a large corporation case, but the pattern is identical in an SME. Many internal applications, customer portals, or admin panels are built with "quick" OTP flows that no one reviews afterward. The flaw doesn't require a sophisticated attacker: just someone who understands the login flow and manipulates it.

Moreover, using AI agents for security testing is no longer science fiction. Just as we talked about local AI for companies, here the debate is the same: does it make sense to integrate these capabilities into our processes, or do we leave them in the hands of third parties without control? The answer depends on risk, but ignoring the trend is not an option.

What we recommend doing

1. Review your OTP flows. Check that the code's destination isn't a user-manipulable parameter and that it's always validated against the data registered on the account.
2. Test in pre-production, but validate in production carefully. A flaw that isn't reproduced in the real environment may go unfixed. Define a protocol for authorized, limited-scope testing.
3. Log and limit your AI agents. If you use automated tools for pentesting or operations, they should have their own identity, minimal permissions, and complete logs.
4. Don't confuse authentication with verification. The second factor must depend on a channel the attacker doesn't control. If they can choose it, it's not a factor.
5. Prioritize by impact, not by CVSS. A login bypass can be more serious than a flaw with a high score but hard to exploit.

The part no one talks about

The news leaves an uncomfortable idea: finding the flaw was the easy part. The hard part was proving it responsibly. That is precisely the difference between a serious audit and an automated scan. At ForgeNEX we see it daily: SMEs don't need more tools, they need judgment to use them and someone to respond when the agent finds something.

An AI agent can find a bypass in minutes. Deciding what to do with that finding is still human work.

If your team isn't clear on who reviews security findings, or how testing on production is authorized, the problem isn't AI: it's the process. And that can be fixed today.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.