# Reflectiz says AI agent exposed insurer login-code bypass

_Published Wednesday, October 14, 2026 at 8:07 AM EDT · Security, AI · Latest · Tier 2 — Notable_

![Reflectiz says AI agent exposed insurer login-code bypass — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_bop9V2vtfHPW4Obd0zupOPpNFCd9N5HtVwWVs9u-njx8RuEgOkAh75uRjWLS_h3zHQ847m7xc01PkVAdKhyphenhyphen5Pkg2Pb_qthWVQe-9lcpKclCOq3ZDpQ2iSfRSFCQQU8gxyBl6lWEjTKWZHn9LiNSq2rQ4_nUIM6Sjcqv5fwgVRnFpiuxpYDfhrkbikLE/s1700-nu-rw-lo-l85-e365/case.jpg)

Reflectiz says its AI testing agent discovered and demonstrated a critical authentication bypass during an authorized assessment of a major insurer's production website. The agent redirected a sign-in code to an email inbox it controlled, completed the login and then halted under its guardrails. Reflectiz reported the finding to the insurer.

The server accepted a delivery address chosen in the login request without checking that it belonged to the account. An attacker would need the required customer identifiers to exploit the flaw. The insurer said it had tested the site about six months earlier, but when the weakness arose is unclear.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html)

---
Canonical: https://techandbusiness.org/newswire/GxPM9ijw6JbRCX-YttSVAS
Published: 2026-10-14T12:07:58.607Z
Story chronology: 2026-10-14T11:00:00.000Z
Retrieved: 2026-10-14T14:53:31.515Z
Publisher: Tech & Business (techandbusiness.org)