This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Hackers exploited Meta's AI support chatbot to gain unauthorized access to high-profile Instagram accounts. By using a VPN to match the target's location and requesting the bot to change the account's associated email address, attackers were able to trigger password resets and hijack accounts. Meta has since resolved the vulnerability.
Hackers reportedly used Meta's AI support chatbot to take over high-profile Instagram accounts by allegedly convincing it to change account email information and trigger recovery flows. Reported targets included the Barack Obama White House account; the account of John F. Bentivegna, the Chief Master Sergeant of the Space Force; Sephora's account; and app researcher Jane Manchun Wong. Meta said the issue had been resolved.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
Meta offloaded critical account security and recovery functions to an AI chatbot without providing a reliable human escalation path, leading to unsafe deployment.
The incident involved security vulnerabilities in Meta's AI support chatbot that were exploited by hackers to gain unauthorized access to high-profile Instagram accounts.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by the Meta AI support chatbot making the decision to change account email addresses without proper verification, which was an unexpected and unintentional outcome of its deployment.
Added categories peak at 2: Minor (Psychological Harm, Inferred)
Hackers successfully exploited Meta's autonomous AI support chatbot to hijack high-profile Instagram accounts, including US government and military profiles. While quickly patched, the incident highlights critical security vulnerabilities in deploying autonomous AI agents for sensitive administrative functions without human oversight, posing risks to official communications.
The Meta AI support chatbot acts as an assistant designed to help users with account recovery, password resets, and security functions under human oversight, though in this case, it was manipulated into performing unauthorized actions.
Limited Risk: The system is an AI chatbot used for customer support and account maintenance, which falls under the category of chatbots requiring transparency and basic safety measures.
The AI system is explicitly described as an AI support chatbot deployed by Meta to handle customer service, account recovery, and security functions.
The report from 404 Media provides clear, detailed, and actionable information regarding the exploit mechanism, the specific accounts affected, and Meta's response. The steps of the exploit are documented with evidence from Telegram channels, and Meta's confirmation of the patch adds high credibility.
None. The incident is a straightforward security exploit of an AI-driven support system.
Technology
Vulnerable AI Support Bot
AI bot changed account email addresses without proper verification.
Weak Verification Logic
Bot sent verification code to the new attacker email instead of old one.
Inadequate VPN Detection
System failed to detect or block location spoofing via VPN.
Data Inputs
Spoofed Location Data
Attackers used VPNs to spoof location and bypass geographic security.
Target Username Lists
Lists of high-value targets and locations aided the exploit.
Human Factors
No Human Escalation Path
Victims had no way to reach human support to report takeovers.
Social Engineering of AI
Attackers manipulated conversational AI to bypass security controls.
Process and Methods
Flawed Password Reset Process
Allowed email changes during reset process via automated chat.
Inadequate Risk Assessment
Meta deployed automated account recovery without sufficient testing.
Management
Prioritizing Automation Over Safety
Meta rushed AI support deployment to offload critical functions.
Inadequate Incident Response
Slow response to exploit that was active for months before patch.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
