Claude-Generated Onboarding Code Exposed Financial Data Through GUID Authorization Bypass

Penetration testers at incident response firm Sygnia have disclosed a critical authorization flaw in a financial services customer onboarding application built with AI assistance, where possession of a globally unique identifier (GUID) was treated as sufficient proof to issue access tokens, potentially exposing sensitive personal and financial records. In a test described on July 28, 2026, researchers led by Principal Penetration Tester Zach Mead found that the AI-assisted application, built substantially with Claude, contained a fundamental architectural flaw: while the codebase implemented proper token expiration, rate limiting, audit logging, and session management controls, it omitted the critical validation step before token issuance—confirming that the requester was actually entitled to receive or restore access to a given applicant's session.