AI Agent Uncovers OTP Channel Manipulation in Insurer Login Flow

The agent mapped JavaScript and API endpoints during reconnaissance, surfaced the OTP request parameters, then executed a live test that switched delivery from SMS to a controlled email address. The server accepted the altered request and issued a valid code, reaching an authenticated state before guardrails halted further actions. This matches OWASP guidance on verifying OTP-to-account linkage but bypassed it entirely due to missing server-side validation.

Evidence comes from the agent's browser-driven workflow logs and a validator agent that reproduced the exact payload sequence. Reflectiz's decade of production site scanning supplied the necessary login context and multi-step flow handling, which most automated tools lack. The finding aligns with patterns in prior auth bypasses where client-controlled delivery fields were trusted without backend verification.

Operational impact centers on any customer identifier exposure allowing account takeover at scale. Insurers handling millions of users face regulatory and financial exposure from such flaws. Independent confirmation would require technical indicators like request/response pairs rather than attribution claims.

Next steps include full endpoint coverage scans and validator runs across similar financial sites. Expect expanded agent use for 2FA and channel-binding tests as production context grows.