AWS Security Agent chains SQL Injection into autonomous login

Discovered during authentication flow verification. With zero credentials provided, the agent autonomously built this attack chain:

1. SQL Injection to extract the users table (plaintext passwords)
2. Recognized TOTP secret JBSWY3DPEHPK3PXP as the RFC 6238 test value
3. Generated valid TOTP codes and logged in as admin
4. Detected vulnerabilities behind authentication

The docs state "Without credentials, the agent can only test publicly accessible pages and APIs" — but this doesn't account for the agent chaining vulnerabilities to gain access. The TOTP guess succeeded because it was a well-known test value, but the SQLi → credential extraction → login flow could happen with any app storing plaintext passwords. Worth knowing that the agent may reach authenticated pages even without credentials.