Meta Confirms Thousands of Instagram Accounts Hacked Through AI Chatbot Exploit

An account takeover incident occurred that exploited a vulnerability in Instagram's AI-assisted account recovery system. Attackers exploited a bug where, during the password reset process, the system failed to verify whether the requesting email matched the email registered to the account.

Through this, attackers could receive a password reset link at an email they controlled and take over the victim's account. Meta notified at least 20,225 people that their accounts had been compromised.

The scope of the damage is as follows:

• Full takeover of Instagram and linked accounts possible
• Access to contact information, date of birth, and profile information
• Access to posts, direct messages (DMs), and account activity history

To respond to the incident, Meta disabled the AI chatbot in question and removed the problematic code path. In addition, to prevent recurrence, the company is conducting a comprehensive review of other chatbot systems on the platform.