Meta's Instagram AI chatbot exploited to hijack high‑profile accounts

Hackers exploited Meta's Instagram customer‑support chatbot, which is powered by artificial intelligence, to reset passwords and gain control of a number of notable accounts. By requesting an email address change, the AI sent a password‑reset code directly to the hacker, who then used the "Reset Password" button to change the account credentials. No identity verification or original password was required.

The breach affected accounts such as former President Barack Obama’s White House Instagram, Sephora, a US Space Force master sergeant, and security researcher Jane Wong. Researchers ZachXBT and Dark Web Informer first disclosed the vulnerability, and some of the stolen accounts were listed for sale at prices up to $1 million. Meta has since patched the exploit and is working to secure the impacted accounts. The attack highlights that accounts without multifactor authentication (MFA) were vulnerable, while MFA would have blocked the hack.