An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.

Reflectiz's AI pentesting agent autonomously discovered a critical authentication bypass on a major insurer's live website by exploiting a flaw allowing OTP delivery to arbitrary email addresses. The vulnerability enabled unauthorized account access by redirecting one-time passcodes away from registered contacts.