Wiz AI Agent Finds Critical Airline API Vulnerability in 15 Minutes

Wiz's autonomous red-team agent discovered a BOLA flaw in an airline booking API, exposing customer data and write access to flights, refunds, and cancellations.

Vulnerability Tools Threat Intelligence

Wiz published research describing an AI red-teaming agent it built that found a Broken Object Level Authorization (BOLA) vulnerability in an airline’s public-facing booking API within 15 minutes of starting its scan. The agent identified the flaw without prior knowledge of the application, working purely from the exposed API surface.

The vulnerability allowed access to other customers’ records, including personal information, flight bookings, and reservation details — a serious data exposure on its own. But the more significant finding was that the same broken authorization also granted write access. The agent demonstrated it could change flight prices, issue refunds to arbitrary accounts, cancel other passengers’ flights, and split passengers out of group bookings — all through the same externally reachable API.

Wiz did not name the airline or disclose how the vulnerability was reported or remediated, which suggests the research was published only after the issue was confirmed fixed. What stands out is not the vulnerability class itself — BOLA is a well-known and common API flaw — but the speed at which an autonomous agent enumerated endpoints, inferred object relationships, and confirmed exploitability without a human operator driving each step.

This pattern is consistent with a broader shift: AI-driven offensive tooling can now perform reconnaissance and exploitation chains that previously required a skilled pentester working over hours or days, compressing that timeline to minutes. For security teams, this raises the bar on how quickly authorization flaws in production APIs need to be caught and fixed, since the assumption that “no one will stumble onto this in time” no longer holds. Reviewing object-level authorization checks on every endpoint that accepts an ID parameter — not just the obviously sensitive ones — is the concrete takeaway here.

Why it matters: Autonomous AI agents are compressing the time from 'API exists' to 'API is fully compromised' down to minutes. If you expose customer-facing APIs, assume both attackers and automated red-teaming tools can now find authorization flaws faster than your manual review cycle catches them.

Read source →