Attackers have exploited a critical vulnerability in Meta’s AI-powered Instagram support chatbot to hijack user accounts without needing passwords, phishing, or malware. Instead of bypassing security through technical exploits, hackers simply manipulated the chatbot via natural-language requests.
Meta’s AI Bot Misused by Hackers
The flaw allowed attackers to bypass two-factor authentication (2FA) effectively. By interacting with the AI support assistant, threat actors could request changes to a target account’s email address.
The chatbot, which had backend access to sensitive account management APIs, processed these requests without verifying the user’s identity through any secondary authentication method.
In a typical attack scenario, hackers first identify high-value Instagram accounts, especially rare “OG” usernames that are highly sought after in underground markets.
To avoid detection, they used VPNs or residential proxies matching the victim’s geographic location. The attacker then initiated a conversation with the AI support bot and requested an email change, providing a new attacker-controlled email address.
Shockingly, the chatbot complied and sent a verification code directly to the attacker’s email. Once the code was relayed back, the bot enabled password reset functionality. Within minutes, attackers gained full control, changed credentials, rotated backup codes, and locked out the original owner without triggering alerts.
Several high-profile accounts were reportedly compromised, including the dormant @obamawhitehouse account, which was later defaced. Other victims included popular short-handle accounts like @hey and @jowo, as well as verified profiles such as Sephora and U.S. Space Force official John Bentivegna. Security researcher Jane Manchun Wong also confirmed her account was taken over.
Researchers identified the issue as a classic “confused deputy” vulnerability, where a trusted system component is tricked into performing unauthorized actions.
In this case, the AI assistant acted as the “deputy” with elevated privileges but lacked strict authentication checks. This aligns with the OWASP Top 10 risks for Large Language Model applications, particularly “Excessive Agency,” where AI systems are granted too much control without safeguards.
Meta acknowledged the issue and quickly deployed a fix, restricting the chatbot’s ability to perform sensitive account actions. The company stated that no internal systems were breached. However, experts argue the incident still represents a serious security failure due to unauthorized account access.
Users are advised to strengthen their account security by switching from SMS-based 2FA to authenticator apps or hardware security keys, using private email addresses not publicly linked to their identity, and regularly reviewing active login sessions. Generating new backup codes and storing them securely is also recommended.
This incident highlights a broader concern: any organization deploying AI assistants with direct access to authentication systems may face similar risks. As AI adoption grows, securing these systems against manipulation becomes critical.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
