Instagram Alerts Users Impacted by Hacker Attacks Using AI Chatbots

The widespread hacking operation, which exploited Meta AI’s chatbot to take over the Instagram accounts of several victims, continues despite the company’s assurances of resolution. In the interim, Meta is focused on safeguarding the compromised accounts and notifying the affected users.

During the weekend, hackers claimed they were using Meta’s AI support chatbot to control various high-profile Instagram accounts. At the same time, many users took to social media to express their concerns regarding their accounts being compromised, with some featuring distinctive short user profile handles.

TechCrunch has come across examples of allegedly hacked accounts showcasing common first names or country names, which can potentially be resold as valuable “OG handles” in an unofficial market. Additional victims of these hacking incidents included an inactive Obama White House account (a claim contested by Meta) and the Instagram account of John Bentivegna, the U.S. Space Force’s chief master sergeant.

The ease of these attacks invites scrutiny over labeling them as hacks, possibly giving the perpetrators undue credit while not adequately holding Meta responsible for their failure to thwart basic account hijacking techniques.

Hackers simply informed Meta’s AI chatbot that they were the legitimate owners of the target account and requested the bot to link that account to an email address they controlled. The chatbot complied without hesitation, enabling the hacker to reset the original account holder’s password and take control—often leaving the genuine owners locked out. No Meta employees or contractors participated in the chat at any time.

On Monday, Meta spokesperson Andy Stone stated that “the issue has already been resolved.”

However, on Tuesday, additional reports emerged of Instagram users experiencing hacks again.

Meanwhile, TechCrunch observed discussions in a Telegram channel where the hacking method had been disclosed, with assertions that they could still exploit Meta’s AI chatbot, alongside listings for allegedly hacked handles for sale concurrent with TechCrunch’s report. (It is crucial to acknowledge that verifying whether all these accounts were compromised using the same method is challenging.)

In a later post on X, Stone mentioned: “Some users might receive password reset notifications, and some may be prompted with security questions when trying to log into their accounts.”

Stone informed TechCrunch via email that Meta secured the affected accounts on Monday and sent out password reset emails. When asked by TechCrunch, Stone did not provide the number of users who were hacked.

Several individuals indicated that Meta has begun notifying users that they were targets.
Victims have publicly announced receiving emails from Instagram alerting them that the company had “detected suspicious activity suggesting that your Instagram may have been compromised.” The message also detailed that the company had taken actions to secure the account and requested the user to reset their password.

As highlighted by 404 Media, Meta announced in March that it would be implementing AI to enhance user support, stating that the AI chatbot was “designed to handle account issues from start to finish,” promising capability to “securely reset your password.” This suggests that the chatbot can perform actions that traditionally required human intervention, given their critical nature.

For years, a thriving trade has existed where hackers pilfer and sell “OG” usernames, referencing the original usernames of the earliest Instagram users. Historically, securing these accounts demanded more complex methods, such as phishing the victim, commandeering their phone number, or bribing insiders within telecommunications firms.

In this case, the hackers merely asked, and Meta’s chatbot promptly complied.