TLDR Tech / InfoSec
Meta confirms thousands of Instagram accounts were hacked by abusing its AI chatbot
Meta has confirmed that at least 20,225 Instagram accounts were hijacked due to a flaw in its AI-assisted account recovery system. A bug in a separate code path failed to verify that the email address provided during a password reset request matched the one on file, allowing the chatbot to send reset links to attacker-controlled addresses simply upon request. This campaign, which ran from approximately April 17 until early June, impacted any account not protected by two-factor authentication (2FA), granting attackers full control over the account, including access to direct messages, posts, contact information, and dates of birth. This incident serves as a cautionary tale for automating account recovery without human oversight, with one observer noting the attack was essentially one AI being tricked by AI-generated verification media without any human intervention to detect it. Meta has since disabled the chatbot, removed the problematic code path, and initiated an audit of its other chatbots.
Read the full story