Meta AI Chatbot Exploit Hijacks Instagram Accounts
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Hackers tricked Meta's AI support chatbot into resetting passwords and changing emails tied to Instagram accounts, bypassing 2FA, per 404 Media's Jason Koebler — a finding confirmed by Krebs on Security, TechCrunch, and The Verge.
- Meta's AI support bot had access permissions allowing it to reset passwords for any user without identity verification, per @zachxbt, who wrote that "the Meta AI support is garbage and has lots of access perms which allowed you to reset passwords to any user without 2FA and did not verify who you are."
- High-profile accounts were compromised, including Obama's old Instagram account and the Chief Master Sergeant of Space Force's account, which @osinttechnical reported was used to post Iranian propaganda for roughly an hour.
- Instagram's Trust and Safety organization was allegedly gutted by ~60% in the weeks before the breach through layoffs and forced reassignments to data labelling, per @gergelyorosz, who blamed Meta's "AI maxxing" for pushing buggy code to production.
- Selfie-based identity verification has been rendered "utterly useless" by AI-generated images and videos, allowing 2FA to be bypassed "by Meta's own design," per @gergelyorosz.
- Meta spokesperson Andy Stone (@andymstone) denied the most extreme claims — that world leaders' DMs were exposed — stating "This claim about world leaders is totally false," and confirmed the issue had been resolved and impacted accounts were being secured.
- The breach occurred roughly a month after Meta deprecated end-to-end encryption, per @nikitabier, who called it "easily the biggest breach in Meta/Facebook history"; @oracles reported hundreds of rare-handle accounts were stolen, some worth hundreds of thousands of dollars.
Why it matters: This was a mass account takeover exploiting a structural design flaw — AI-powered support with excessive permissions and no identity verification — that compromised hundreds of accounts including government and military officials. The alleged 60% gutting of Instagram's Trust & Safety team in the weeks prior suggests organizational decisions directly enabled the breach rather than preventing it, exposing the cost of Meta's AI-first restructuring.
Ask SkimNews
