# AI Agent Uncovers Critical OTP Bypass Vulnerability in Major Insurer's Website

*Published October 16, 2026*
*Source: [https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html](https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/ai-agent-uncovers-critical-otp-bypass-vulnerability-in-major-insurer-s-website) or [see plans](https://www.sec-news.ai/pricing).*

## Article

An AI-driven pentesting agent from Reflectiz has autonomously identified a severe authentication vulnerability in a major insurer's live website. The flaw allowed the redirection of a one-time passcode (OTP) to an email address of the attacker's choice, bypassing standard authentication procedures. This issue arose because the login process permitted the alteration of the delivery channel and address for the OTP, failing to verify that the new address was associated with the legitimate user account. 

Reflectiz's AI agent, designed to map website workflows and identify vulnerabilities, executed a targeted test on the insurer's site. It discovered that the server did not verify the binding of the OTP to the correct user account. This breach allowed the agent to successfully redirect a login code to an email it controlled, proving the existence of a serious security flaw. Upon confirming the bypass, Reflectiz promptly reported the vulnerability to the insurer for remediation.

This discovery highlights a critical gap in the insurer's authentication process, which could have been exploited by attackers with access to customer identifiers. While traditional pentesting had been conducted on the site six months prior, the AI agent's continuous monitoring approach proved more effective in identifying this newly introduced flaw.

Reflectiz's agentic pentesting offers a dynamic solution to evolving web security challenges, providing ongoing assessments that adapt to site changes. This method contrasts with the static nature of traditional pentesting schedules, which may not keep pace with rapid website updates. The AI-powered tool not only enhances testing frequency but also maintains cost efficiency, ensuring comprehensive coverage and rapid identification of vulnerabilities.