Reflectiz AI agent found OTP redirect flaw on major insurer's login

An AI pentesting agent from Reflectiz autonomously found a critical authentication bypass on a major insurer's production login: the server sent one-time passcodes to any attacker-supplied email address without checking it belonged to the account. The vendor claims up to 10x the testing capacity of manual pentesting at the same cost.

• Switching OTP delivery to email and setting an attacker inbox let the code be intercepted
• The insurer had pentested the site about six months before the flaw was found
• Reflectiz claims up to 10x testing volume at the same cost as manual pentests
• Fix: bind the code to the account server-side across every delivery channel