Hackers Exploit Meta’s AI Support Chatbot to Seize Control of Instagram Accounts

Instagram has resolved a security issue that allowed multiple user accounts to be compromised. The breach involved tricking Meta’s AI-driven support chatbot into granting access to a victim’s account.

Recently, numerous Reddit users reported that their Instagram accounts had been hacked, with many individuals on X warning about similar breaches. Among the compromised accounts was the official handle associated with the Obama administration, which has been inactive since 2017, alongside that of John Bentinvegna, chief master sergeant of the U.S. Space Force.

Security expert Jane Wong also reported that her Instagram account was taken over.

“My password was changed without my authorization, and I received several password reset requests throughout yesterday,” Wong stated. “It’s quite concerning.”

A video shared on X demonstrated how to gain unauthorized access to someone’s Instagram account. The hacker used a VPN to obscure the target’s location, circumventing Instagram’s automated security protocols. The hacker then initiated a conversation with the Meta AI Support Assistant, asking the bot to add a new email address to the victim’s account. The chatbot sent a verification code to the email provided by the hacker, who then relayed the code back to the chatbot, prompting the option to “Reset Password.” The hacker entered a new password and successfully took control of the victim’s account.

TechCrunch verified that the hacker’s publicly accessible email address, featured in the video, received the verification code successfully.

This attack took advantage of the fact that the hacker did not require access to the legitimate email address linked to the victims’ Instagram accounts.

On Monday, Instagram representative Andy Stone addressed Wong and others, confirming that the issue has been resolved. The precise number of Instagram users impacted by the unauthorized access is still unclear.

Meta has not yet responded to TechCrunch’s request for comments.