Reflectiz says AI agent exposed insurer login-code bypass

Reflectiz says its AI testing agent discovered and demonstrated a critical authentication bypass during an authorized assessment of a major insurer's production website. The agent redirected a sign-in code to an email inbox it controlled, completed the login and then halted under its guardrails. Reflectiz reported the finding to the insurer. The server accepted a delivery address chosen in the login request without checking that it belonged to the account. An attacker would need the required customer identifiers to exploit the flaw. The insurer said it had tested the site about six months earlier, but when the weakness arose is unclear.