An authorized Reflectiz assessment uncovered a critical authentication flaw on a major insurer’s live website: a login code intended for an account’s phone number could be redirected to an email inbox chosen in the request. The AI agent stopped after proving that the code worked, but the incident shows why demonstrating a suspected bug safely can require more care than finding the suspicious parameters.
What the AI agent discovered
The insurer’s production site was described by The Hacker News in 2026 as serving millions of users. During an authorized assessment, Reflectiz’s AI pentesting agent mapped the real login journey, requested a one-time password (OTP), and caused the code to be delivered to an email inbox under the tester’s control. Entering that code completed authentication. Its safety controls then halted the test instead of allowing further activity.
As an Amazon Associate I earn from qualifying purchases.
The report does not identify the insurer, assign a CVE, say when the weakness was introduced, or describe the insurer’s remediation. It therefore demonstrates a confirmed bypass, not a public exploit campaign or a complete account-takeover investigation.
How the OTP bypass worked
The login request carried two delivery controls: one selected the channel and another supplied the destination address. The normal path sent a code by text message to the phone number already associated with the customer’s account. By changing the channel to email and providing a different address in the request, the tester made the server send the code to an unregistered inbox.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The underlying failure was missing account binding. The server treated client-supplied delivery details as trustworthy instead of checking, on the server, that the destination belonged to the account whose login was being challenged. An attacker who already possessed the customer identifiers required to begin the flow could potentially use the same weakness to enter that customer’s account. The finding does not show that identifiers were publicly exposed or that anyone exploited this particular site.
Why this breaks the security property of an OTP
An OTP is useful only when the challenge is tied to the right account and delivered through an approved channel. A valid six-digit code proves little if an attacker can decide where the server sends it. In this case, the code itself was generated and accepted normally; the authorization boundary failed because the destination was not bound to the account.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why proving the bug was harder than spotting it
The agent first inspected JavaScript and observed API calls. Fields that appeared to control channel and destination suggested a hypothesis, but a parameter name or client-side option is not evidence of an authentication bypass. The agent had to construct a narrowly targeted test that changed both values, run the live multi-step login flow, receive the code, and verify that the resulting session authenticated successfully.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThat proof also had to be bounded. Once authentication succeeded, guardrails stopped the operation. The tester did not continue into the account, alter data, enumerate other users, or attempt persistence. This distinction matters in production: a safe assessment proves the minimum fact needed to report risk while preventing unnecessary impact.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why browser context made the difference
Reflectiz says it has spent more than a decade scanning thousands of production websites. That accumulated context includes logging in, receiving verification codes, and navigating multi-step workflows. The agent could therefore operate a real browser through customer-like OTP and two-factor authentication (2FA) screens rather than testing only an exposed login endpoint.
Many authentication defects appear only after several state changes: a session cookie is issued, a challenge is created, a delivery method is selected, and a code is verified. A scanner that never completes those transitions may see the input fields but miss the broken relationship between them.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How the assessment model validated the finding
The OTP investigation ran alongside other attack plans. Reflectiz describes combining open-ended exploration with a structured plan that checks every discovered endpoint against relevant attack categories. A separate validator agent then reproduces each suspected issue using the same payload and context.
The resulting coverage record lists the tests performed, their outcomes, and explicit exclusions. That record is important: a confirmed OTP bypass is a serious result, but it is not evidence that every endpoint, role, workflow, or authorization rule was tested.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What this says about scheduled pentests
The insurer reportedly had pentested the site about six months before the AI assessment. The available account does not establish whether the OTP weakness existed at that earlier point or entered in a later release. It does illustrate a timing problem: production websites change with each deployment, while conventional pentests are periodic snapshots.
| Testing approach | What the incident illustrates |
|---|---|
| Scheduled penetration test | A point-in-time assessment; the insurer’s previous test was reported as about six months earlier. |
| Repeatable production testing | Can revisit changed workflows more often when authorization, scope, access, and safety boundaries are explicit. |
| Agent-plus-validator model | Exploration finds hypotheses; a separate run reproduces a suspected result and records coverage, outcomes, and exclusions. |
Continuous testing is not automatically better. It can create operational risk if an agent has excessive permissions, unclear targets, or no stop conditions. Its value comes from safe repetition against the parts of the application that actually changed.
Defensive controls that would prevent this class of flaw
- Bind the challenge to the account. Store the account identifier, approved destination, channel, expiry, attempt limit, and challenge state on the server when the OTP is created.
- Ignore untrusted destination overrides. A client may request a channel, but the server must resolve the destination from verified account data or require a separate, authenticated change process.
- Validate at send and verify time. Check that the destination used to deliver the code and the challenge being verified belong to the same account and active login transaction.
- Exercise the complete workflow. Test login, OTP, 2FA, recovery, session issuance, and logout, not just the first page or API endpoint.
- Use production guardrails. Define written authorization, target scope, rate limits, test identities, data-handling rules, and an automatic stop after the minimum proof.
- Keep a coverage record. Record tested endpoints, attack categories, outcomes, and exclusions so one confirmed finding is not mistaken for full security coverage.
- Evaluate account-bound alternatives. Hardware security keys and other phishing-resistant methods may reduce dependence on transferable codes, but selecting a control requires a separate assessment of deployment and recovery needs.
What readers should—and should not—conclude
The incident shows that an AI agent can discover and safely confirm a production authentication bypass when it has browser context, suitable access, and strict boundaries. It does not show that AI replaces human authorization, threat modeling, remediation, or incident response. Nor does it establish that the insurer’s customers were compromised.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Reflectiz has claimed up to 10 times the testing capacity at the same operational cost. In the company’s framing, that figure refers to testing volume; it does not guarantee finding 10 times as many vulnerabilities. The practical question for a security team is whether repeatable, bounded checks cover the workflows that change between formal assessments without turning live systems into uncontrolled test targets.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
