AI agent rerouted an insurer's login code to itself

The login request on a major insurer’s production site carried two fields that decided where your one-time passcode went: a delivery channel and an address. By default the code went by text to the phone number on the account. Change the channel to email and set the address to an inbox you control, and the server mailed the code to that inbox. It never checked that the address belonged to the account.

That is a critical authentication bypass, and an AI pentesting agent from Reflectiz found it on its own during an authorized assessment. The agent was mapping the login flow, requested a code, directed it to an inbox it controlled, and watched the code arrive and the login complete. Its guardrails stopped the test at that point. Reflectiz reported the bug to the insurer, which runs the site for millions of users.

The bug class is as old as OTPs. A one-time passcode only proves identity if it is delivered to a destination already linked to the account. The SMS path kept that link; the email path dropped it. OWASP’s testing guide asks the question directly: “Are the OTPs tied to the correct user account…?” Here the answer was no, at least on one channel. Anyone holding the customer identifiers the login flow required could redirect the code and take the account.

Changing one field is the whole attack. Getting an automated system into position to prove it is the part most tools skip. The agent started with reconnaissance on the site’s JavaScript and the API calls behind its pages, which surfaced the OTP request and the two values that looked like they controlled delivery. Values like that are a hypothesis, not a finding, because the server might reject the change or override it later in the flow. So the agent built a test around both values and ran it through the live login, confirming the server honored the attacker-supplied address.

Reaching that point means handling everything in front of it. Plenty of scanners stop at the login gate, which leaves the authenticated workflows, the part that matters, untested. Reflectiz’s argument is that a decade of scanning production sites already taught its system to log in, receive verification codes, and walk multi-step flows, so the agent, built by CTO and co-founder Ysrael Gurt, drives a real browser through OTP and 2FA rather than starting from a blank URL.

The OTP test did not run alone. Reflectiz pairs open-ended investigation with a structured sweep: every discovered endpoint against every applicable attack category, plus a separate validator agent that reproduces each suspected finding with the same payload and context before it is reported. The output is a coverage record of which tests ran, their outcomes, and what was excluded. One confirmed bug tells you something broke, not how much of the application was checked.

The insurer said it had pentested the site about six months earlier. This assessment still found an exploitable login flaw, and it is unclear when the weakness was introduced. A point-in-time test can only speak for the code that existed when it ran. Sites ship on their own schedule; pentests run on a calendar. A missing destination check is exactly the kind of regression a refactor of the login flow can reintroduce between test windows, and nothing on a fixed schedule will catch it until the next pass.

Reflectiz says its approach delivers up to 10x the testing capacity at the same operational cost as manual pentesting, framed as testing volume rather than a promise of more vulnerabilities found. That figure is the vendor’s claim, but the regression gap it sells against is genuine.

The engineering fix is small and worth stating plainly: the binding between a one-time code and the account it authenticates belongs on the server, enforced on every delivery channel, and verified by a test that reruns whenever the login flow changes.