Meta AI Support Bot Let Hackers Reset Instagram Passwords

*Hackers prompted Meta’s AI assistant to change email addresses on target accounts, seizing control of high-profile Instagram profiles including the Obama White House and the Chief Master Sergeant of the U.S. Space Force.*

Hackers gained brief access to several prominent Instagram accounts over the weekend by exploiting Meta’s AI support assistant. They used the bot to alter the email address tied to an account, then reset the password without further checks.

The method spread on Telegram. Attackers simply asked the bot to update the email on a chosen account. Once the change went through, they requested a password reset to the new address and took over.

Meta rolled out the AI assistant in December to handle common support tasks around the clock. The tool was meant to cover scam reports, content removal questions, and password resets. The reset function proved the weak point.

No verification step stood between the bot’s action and the account change. Reports show the same steps worked on multiple targets before the accounts were restored.

Why it matters

An AI system granted authority over account recovery created an open path for takeover. The incident shows what happens when support automation receives sensitive permissions without matching safeguards. Companies that hand account controls to chat interfaces will face repeated tests of those limits until verification matches the access granted.

---

Sources:

• Krebs on Security
• MacRumors

{
  "excerpt": "Hackers used Meta’s AI support bot to change emails on Instagram accounts and reset passwords, briefly seizing high-profile profiles.",
  "suggestedSection": "security",
  "suggestedTags": ["meta", "instagram", "ai-support", "account-hijack"],
  "imagePrompt": "An abstract scene of a glowing digital interface floating above a dark desk, with a single hand reaching toward a disconnected email envelope icon. Muted color palette, cinematic lighting, 16:9."
}