Evidence · DiggingBeagle record
Reflectiz: AI pentesting agent discovered insurer OTP bypass
Reflectiz describes an authorized offensive agent reading site JavaScript and changing an OTP API request so a code was delivered to the tester rather than the targeted insurance customer. Vendor case study; insurer unnamed and raw transcript absent.
- Published
- Oct 8, 2026
- Publisher
- Reflectiz
- Source role
- vendor statement
Evidence record
Reflectiz describes an authorized offensive agent reading site JavaScript and changing an OTP API request so a code was delivered to the tester rather than the targeted insurance customer. Vendor case study; insurer unnamed and raw transcript absent.
Claim-level citations (1)
- supportsAI pentesting agent finds writable OTP delivery destination: Reflectiz reports its Offensive Hub agent read client-side JavaScript, altered a one-time-code request to control the recipient, received the code and succeeded in logging in before guardrails stopped further access.
Section A critical login flaw