Hackers exploit Meta AI chatbot to hijack Instagram accounts
Hackers exploited a vulnerability in Meta's AI customer service chatbot to compromise over 20,000 Instagram accounts by bypassing geographic security controls and manipulating the bot into changing account recovery email addresses. Meta discovered and patched the vulnerability on May 31 and June 1 respectively.
What happened
Hackers exploited a vulnerability in Meta's AI customer service chatbot to hijack over 20,225 Instagram accounts between April 17 and early June 2026. The vulnerability was discovered on May 31 and patched on June 1.
Attackers used VPN to spoof the geographic location of target accounts, bypassing location-based Instagram security measures. They then initiated a password reset request through the AI chatbot and requested that the linked email address be changed to their own email. The chatbot complied with the request, sent a verification code to the attacker's email, and displayed a password reset button after the code was submitted, allowing account takeover without accessing the victim's email.
Reported impact
Accounts lacking two-factor authentication were targeted. Once attackers gained full control of compromised accounts, they could access contact information, birthdays, personal data, posts, private messages, and account activity history.
Notable accounts reportedly affected included the White House official archive account from former president Barack Obama's administration and the official account of United States Space Force Master Chief John F. Bentivegna.
Index analysis
The AI chatbot's design prioritized reducing friction for legitimate users seeking account recovery, allowing quick access without remembering passwords or waiting for human support. However, the system failed to enforce basic email ownership verification, creating a fundamental security gap between understanding user intent and executing proper validation checks.
Governance controls
Meta temporarily disabled the AI customer service tool, removed vulnerable code, invalidated all password reset links generated through the vulnerability, and implemented forced security checks for affected accounts requiring identity verification before login. Accounts with two-factor authentication enabled were not compromised.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.