Meta Reports 20,225 Instagram Hacks via AI Chatbot
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Meta notified at least 20,225 people, including 30 in Maine, that their Instagram accounts were compromised.
- Meta said the breach exploited a vulnerability in its AI‑assisted account recovery system that let password resets be sent to any email address without verifying it matched the account holder’s email.
- Meta's AI chatbot was tricked into sending a password‑reset link to an email the hackers controlled, allowing password resets for accounts without two‑factor authentication.
- Instagram accounts were compromised from around April 17 until the week of the announcement, when Meta secured the chatbot.
- Meta has disabled the Instagram AI chatbot, removed the faulty code path, and is reviewing other chatbots across its platforms to prevent similar abuse.
- Meta said it is unaware of what personal information was accessed and did not respond to a press inquiry.
Why it matters: The breach directly impacts the 20,225 Instagram users who lost control of their accounts and potentially personal data, while Meta must overhaul its AI‑assisted recovery flow and restore trust after disabling the chatbot, a costly remediation that may affect its platform security reputation.
