iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An authorized AI pentesting agent bypassed a major insurer’s one-time-passcode (OTP) login control by changing two values in a live request: the delivery channel and the destination address. The server sent the code to an inbox controlled by the tester, accepted the code, and completed authentication. The agent’s safety controls stopped the test immediately after confirmation.
The important lesson is not that an AI guessed a clever exploit. The request manipulation was straightforward. The difficult work was establishing that a suspicious API design flaw really crossed the account boundary, proving it in production without going further, and recording exactly what had—and had not—been tested.
What happened on the insurer’s production site
During an authorized assessment described by The Hacker News in 2026, Reflectiz’s AI agent mapped the login journey of a production website serving millions of users. The normal process delivered a verification code by text message to the phone number already associated with a customer account.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe agent requested a code, changed the request so delivery used email, and supplied an email address it controlled. The code arrived there. Entering it completed the live login flow, demonstrating that the application accepted a code sent to an address unrelated to the account. Guardrails then halted further activity and the finding was reported to the insurer.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The insurer is not named in the report. It does not publish a CVE, say when the weakness was introduced, or describe a remediation. The report also does not show that arbitrary accounts could be accessed without first obtaining the customer identifiers required by the login process.
How the OTP binding failed
An OTP is useful only when the server binds the challenge to the intended account and to a trusted delivery destination. In this case, both the channel and destination were controllable through the login request, and the server did not verify that the supplied destination belonged to the account.
| Stage | Expected behavior | Observed behavior | Security consequence |
|---|---|---|---|
| Delivery channel | Use the account’s registered phone number. | The request could select email instead. | A client-controlled field changed where the challenge went. |
| Destination | Use a server-side address already bound to the account. | The request supplied an email address. | The code could be redirected to an unregistered inbox. |
| Verification | Accept only a code issued for that account and trusted destination. | The code sent to the tester’s inbox authenticated successfully. | The OTP no longer proved control of the customer’s registered channel. |
A person who has the identifiers needed to start a customer’s login could potentially exploit this weakness to enter that customer’s account. The bypass does not mean that every account was exposed with no prerequisite; it means the second factor failed to enforce its intended account-binding property.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why proving the flaw took more work than finding it
The agent did not treat a suspicious parameter as a confirmed vulnerability. It first inspected the site’s JavaScript and the API calls made by the browser. The presence of fields resembling a delivery channel and destination suggested a hypothesis, but static clues alone could not show whether the server trusted them.
- Map the real flow. The agent identified the requests used to start authentication, request a code, and submit that code.
- Form a narrow hypothesis. It focused on whether changing both delivery fields would redirect a challenge without changing the account being authenticated.
- Run a bounded live test. It executed the altered request in the production browser flow, using an inbox under the tester’s control.
- Check the security boundary. The decisive signal was successful authentication with the code delivered to the unregistered address.
- Stop on proof. Guardrails prevented additional account actions after confirmation, limiting impact while preserving evidence.
This sequence matters because an API field can be ignored, normalized, or rejected by server-side logic. Only the end-to-end result established that the destination was trusted incorrectly.
Why browser and workflow context mattered
Reflectiz says it has spent more than a decade scanning thousands of production websites. That accumulated context includes logging in, receiving verification codes, and navigating multi-step customer workflows. The agent could therefore operate a real browser through OTP and two-factor-authentication steps instead of stopping at an exposed login endpoint.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Many authentication defects appear only after several state changes: a session is created, a challenge is requested, a channel is selected, and a code is verified. Testing a login page in isolation would not demonstrate whether those states remain tied to one account and one destination.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How the assessment recorded coverage and validated the result
The OTP investigation ran alongside other attack plans. Reflectiz describes combining open-ended exploration with a structured plan that tests each discovered endpoint against applicable attack categories. That combination reduces two different risks: missing an unexpected path and failing to check a known class of weakness.
A separate validator agent reproduced each suspected finding with the same payload and surrounding context. The resulting coverage record lists tests, outcomes, and exclusions. That record is important: a confirmed OTP bypass is a strong finding, but it is not evidence that every endpoint, role, or attack category was assessed.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What the incident says about scheduled penetration tests
The insurer said its site had undergone a penetration test about six months earlier. The available account does not establish whether the OTP weakness existed at that time or entered the application later. It does illustrate the time gap created when a website changes with every release but testing happens only on a fixed schedule.
| Model | Strength | Constraint |
|---|---|---|
| Scheduled penetration test | Provides a deep, bounded assessment at a defined point in time. | New releases can create exposure between test windows. |
| Repeatable production testing | Can revisit changed workflows more often and maintain a running coverage record. | Requires explicit authorization, safe limits, suitable access, and reliable validation. |
Reflectiz claims that its approach can provide up to 10 times the testing capacity at the same operational cost. That figure refers to testing volume; it is not a promise of finding ten times as many vulnerabilities. More frequent testing improves the chance of catching regressions only when the agent is allowed to reach the relevant workflows and the organization reviews the results.
Defensive actions for OTP implementations
Bind every challenge on the server
- Derive the delivery destination from the authenticated account record, not from a client-selected email or phone value.
- Store the account identifier, channel, destination, purpose, expiration, and attempt state with the challenge.
- Reject verification if any of those attributes changes between issuance and submission.
- Log channel and destination changes as security-relevant events and alert on unusual combinations.
Test the complete authenticated workflow
Include code-request, resend, channel-selection, fallback, recovery, and code-verification endpoints. Exercise them through the same browser and session transitions a customer uses. A test that checks only the initial login page can miss a vulnerable API called later in the flow.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect production assessments with clear boundaries
Written authorization should define domains, accounts, data handling, rate limits, stopping conditions, and the actions an agent may take after authentication. Guardrails should stop on proof of access, prevent destructive changes, and preserve enough request context for a reviewer to reproduce the result safely.
Keep a coverage and exclusion record
For each endpoint and attack category, record the payload, outcome, validator result, and reason for any exclusion. This prevents teams from treating one confirmed issue—or one clean test—as a complete security assessment.
Evaluate stronger account-bound authentication
Hardware security keys and other phishing-resistant methods can be considered as a separate mitigation path because they bind authentication more tightly than a code delivered through a redirectable channel. The incident report does not test or endorse a particular product, so deployment decisions still require an assessment of recovery, accessibility, device support, and user enrollment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What is still unknown
- The insurer’s identity and the affected application version are not disclosed.
- The report does not say when the defect was introduced.
- No remediation timeline or confirmation of a fix is provided.
- No CVE or independent exploitability measurement is reported.
- The account identifiers an outside attacker would need are not specified.
The central finding is nevertheless clear: an OTP is not an account-bound second factor when a request can redirect its delivery and the server accepts that redirected code. Continuous, carefully bounded testing can expose that class of regression between scheduled assessments, but only if organizations pair frequent execution with authorization, workflow-level coverage, and reproducible validation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
