US investigators posing as businessmen were easily able to obtain a licence to buy enough nuclear material to make a small "dirty bomb", Congress has heard.
Senator Norman Coleman said a post-9/11 mindset was needed
The team, who set up a bogus company, said the operation exposed serious flaws in the way the Nuclear Regulatory Commission (NRC) approves licences.
It took only four weeks and some phone calls and faxes to get the document.
The NRC says it has already taken steps to address the problem. The sting was carried out at the request of Congress.
Investigators from the Government Accountability Office (GAO) said they had not even had to leave their desks to acquire the licence.
Report author Gregory Kutz told a Senate hearing that the sting clearly showed the NRC control process "did not work".
"Given that terrorists have expressed an interest in obtaining nuclear material, the Congress and the American people expect licensing programmes for these materials to be secure," Mr Kutz said.
Posing as businessmen, the investigators told the NRC they needed equipment using radioactive isotopes americium-241 and cesium-137 used in construction.
They received the licence without checks on their premises and were then able to duplicate and alter the document to remove restrictions on how many they could buy.
Edward McGaffigan, commissioner of the NRC, told the hearing that the agency had solved the problem in the short term and was working on longer-term fixes.
Republican Senator Norm Coleman, of the Homeland Security investigations sub-committee which commissioned the sting, warned that the NRC was operating with a "pre-9/11 mindset in a post-9/11 world".
"It is clear that terrorists are interested in using a dirty bomb to wreak havoc in this country," he said.
"The economic and psychological effects of a dirty bomb detonating on American soil would be devastating."
Earlier this week, Homeland Security chief Michael Chertoff said he had a "gut feeling" that the US faced a higher threat of terror attack this summer.
In March last year, in a separate operation, undercover GAO agents managed to cross the border into the US from Canada and Mexico with enough radioactive material for two dirty bombs.
Despite radiation detection alarms going off, border guards let them through after being shown false paperwork.