Meta AI support bot exploited to hijack high‑profile Instagram accounts

A flaw in Meta's AI‑powered Instagram support chatbot let attackers reset passwords by redirecting recovery emails to addresses they controlled. By tricking the bot, hackers gained access to several high‑profile accounts, including the Obama White House Instagram page, former President Barack Obama’s former White House account, Sephora, and a senior U.S. Space Force official. Meta confirmed the vulnerability, said it has been patched, and is protecting the affected accounts.

The incident highlights new security risks associated with integrating artificial‑intelligence systems into sensitive user‑support functions. Security experts describe the technique as a form of “prompt injection,” where the AI is misled to perform actions that normally require strict identity verification. Users are advised to enable two‑factor authentication, review linked email addresses and phone numbers, and monitor login activity to mitigate future hijacking attempts.