Instagram AI chatbot tricked by hackers to give access to others' accounts

Instagram has resolved a security flaw that allowed hackers to manipulate its AI support chatbot into granting access to other users' accounts, a Meta spokesperson confirmed. The vulnerability enabled attackers to change the passwords of targeted accounts by faking their location and instructing the AI assistant to swap the associated email addresses, according to screenshots and videos shared on social media [1]. Meta spokesperson Andy Stone stated, "This issue has been resolved and we are securing impacted accounts" [1]. Stone separately dismissed claims that the exploit was used to compromise accounts belonging to world leaders as "totally false" [1]. Tech outlet 404media reported that posts detailing the vulnerability coincided with a series of high-profile account takeovers, including a verified account used by former U.S. President Barack Obama during his time in the White House [1]. That account reportedly posted pro-Iran content before it was recovered [1]. Security researcher and former Meta security engineer Jane Manchun Wong said her Instagram password "got changed without my knowledge and I was getting different password reset attempts throughout yesterday," calling the situation "quite concerning" [1]. The incident highlights persistent security challenges on Meta's platforms. Instagram, which was acquired by Facebook in April 2012 for approximately US$1 billion in cash and stock, has grown to over 1 billion registered users as of June 2018 [7]. Its parent company, Meta Platforms, reported approximately 3.07 billion monthly active users on Facebook alone as of December 2023 [2]. The company has faced repeated criticism over user privacy and data security, most notably during the Facebook–Cambridge Analytica data scandal [2]. The exploit surfaced as Meta faces scrutiny over its customer support systems. An independent body that hears disputes from social media users in the European Union reported last week that Meta virtually never replies when it raises cases of people who say they have been wrongly banned from their accounts [1]. One user affected by the AI vulnerability wrote on X, "We're at the point where one AI stole it and another can't fix it, zero humans in the loop anywhere" [1]. The BBC has asked Meta whether human support workers are available to assist users whose accounts have been hacked [1]. Meta has recently made substantial workforce reductions while directing billions of dollars toward artificial intelligence development [1]. The company's broader portfolio includes WhatsApp, which had 3 billion monthly active users as of May 2025 and was acquired by Facebook in February 2014 for roughly US$19.3 billion [4].