{"data":{"id":"24fbdddc-3a1d-405b-afbc-b90f70d82bd3","title":"An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.","summary":"During an authorized assessment, Reflectiz's AI pentesting agent found a critical authentication bypass on a major insurer's production website without human direction. The login OTP request accepted channel and address fields that let the code be sent to an arbitrary email address instead of the one registered to the account, and the server never checked that the address belonged to the account. The agent stopped after confirming login, and Reflectiz reported the flaw to the insurer.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html","publishedAt":"2026-10-14T11:00:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Reflectiz AI pentesting agent"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-14T11:00:00.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null}}