A major insurer’s login API let users redirect one-time codes to unregistered email addresses.

During an authorized test, Reflectiz’s AI agent sent the code to its own inbox and logged in.

The flaw could allow account access with the required customer identifiers

Read → https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html