At the end of May, an instruction appeared on Telegram channels that allowed you to take over someone else’s Instagram account without knowing the password and without access to the victim’s mailbox. All you needed was a chat with Meta AI.
Meta confirmed that 20,225 accounts were compromised using this method, and the victims included the dormant Obama White House page, the profile of the Sephora cosmetics chain and the account of a high-ranking US Space Force officer.
How did Meta AI chat help take over Instagram accounts?
Hackers took over accounts by instructing the Meta AI chatbot to link the victim’s profile to their own email address, to which the system sent a password reset link. They didn’t crack passwords or break into other people’s mailboxes, the entire attack came down to a conversation with the chatbot.
According to Meta’s filing, the vulnerability was detected on May 31, 2026, and the Maine Attorney General’s log shows April 17 as the likely date of the first attack. This would mean that thevulnerability remained open for approximately six weeks, although Meta has not officially stated when the attacks began.
What was the vulnerability in the Meta AI chatbot?
The weak link turned out to be High Touch Support (HTS), an artificial intelligence-supported account recovery system launched in March 2026. Meta built it to relieve slow service for users cut off from Instagram.
As the company admitted in a breach report filed with the Maine Attorney General, the tool itself worked as intended, but an error in a separate code path meant that thesystem did not verify whether the specified email address even belonged to a given account. Instead of rejecting such a request, it sent a reset link to a foreign address. The mechanism that failed was a missing authorization check in the backend of the recovery process.
What did the Meta AI chat attack look like step by step?
The script itself was very simple. The attacker connected via VPN from an IP address near the victim’s typical location, probably to make the reset request look credible and not arouse the system’s suspicion.
Then it would ask for a password reset and go to the chat with Meta AI. There, he instructed the chatbot to link the account to a new email address, which received a one-time code.
This allowed me to set a new password and log in to someone else’s account. There was one condition: the victim’s account could not have two-factor authentication enabled (2FA).
What does this attack teach about the security of AI agents?
The chatbot was able to perform serious operations, such as password reset or email change, but it had no way to verify that the real account owner was asking for them. The same mistake, powerful permissions without identity checks, is repeated in a whole class of attacks targeting AI agents.
Why is chatbot a new cyber attack surface?
The problem is not the artificial intelligence itself, but the scope of powers it has been given.
This is a fundamental architectural flaw. The model was granted permissions for sensitive operations without proper access control.
The attack is similar to social engineering used against human consultants: instead of breaking security, the attacker simply asked to perform the operation and the system carried it out.
Some of the experts quoted by Reuters classified the incident as prompt injection, i.e. conversational manipulation of the model. It is worth noting, however, that the technical explanation of Meta’s own technical explanation points not to a vulnerability of the language model, but to a missing verification in the code handling password reset. Regardless of the classification, the conclusion remains the same: the bot was given the right to perform sensitive operations without a mechanism to check who is asking for them and on what basis.
The scale of the potential for harm increases as more platforms turn to chatbots to handle logins, password resets, and account recovery. Ian Goldin from Black Lotus Labs warns that we are entering uncharted territory and that similar attacks will increase. Engin Kirda from Northeastern University put it bluntly: People used to be the targets of fraud, now they are AI agents.
Prompt injection and the security of AI systems. How to model threats?
How to protect your Instagram account from being taken over by hackers?
Two-factor authentication turned out to be the most effective barrier. According to the hackers themselves, the exploit did not work against any account with MFA enabled, and even the weakest variant, i.e. the SMS code, blocked it.
However, it is worth using more powerful methods, i.e. a hardware key or passkey. The SMS code, although sufficient in this case, remains susceptible to taking over the victim’s number (SIM swapping), so it should not be the only line of defense.
Since the attack involved connecting a foreign email address to the account, it is also worth checking in the Account Center whether an unknown address or phone number has been assigned to the profile and deleting such entries.
Following the discovery of the vulnerability, Meta disabled HTS and invalidated generated links, forced password resets on affected accounts and placed them under a mandatory security checkpoint, and announced a review of similar recovery processes on its platforms.
How to protect your organization against AI attacks?
The case of Instagram is a textbook example of a threat that we have analyzed in the free series “AI vs Cybersecurity”. Four episodes show not only how cybercriminals use GenAI for attacks, but also how to use AI in everyday work CISO to effectively protect the organization.
The closest episode to the described attack is episode number three: Attacks on AI. We explain how to model and minimize the risk of attacks against AI systems, including model manipulation and prompt injection. This is a related class of threats that the Meta AI case clearly exposed: an agent with the right to perform sensitive operations becomes a target when there is no control over who requests them and on what basis. In addition, we provide a shortened step-by-step guide on how to reduce such risk in practice.
The remaining episodes expand on this picture:
- In the first episode – AI Atakuje – we show how criminals use AI for social engineering attacks and automation of activities; The package includes a checklist of 15 questions for CISOs and a guide to recognizing phishing.
- Shadow AI(ep.2) addresses the uncontrolled use of AI tools by employees and provides the AI Act validator, a guide to the safe use of AI at work, and a checklist for managing Shadow AI in the organization.
- AI as CISO support, the last episode in the webinar series, reverses the perspective and shows how to use artificial intelligence on the defense side.
Access to recordings and all materials is free. Just fill out the form on the website cyklu AI vs Cybersecurity.
Get access to recordings and materials from the free AI vs Cybersecurity webinar series
Sources:
https://krebsonsecurity.com/2026/06/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts
https://insideretail.asia/2026/06/04/how-the-sephora-instagram-hack-exposed-metas-ai-weakness/
