Hackers hijacked Instagram accounts by tricking Meta AI support chatbot into granting access

A significant security breach on Instagram has been addressed, revealing a concerning vulnerability that allowed hackers to gain unauthorized access to user accounts. The incident appears to have exploited a flaw in Meta's AI-driven support chatbot, which was manipulated into granting access to victims’ accounts. Reports from numerous users on Reddit and X highlighted the alarming trend of account hijackings over the weekend. Among the compromised accounts were notable handles, including one associated with the Obama-era White House, which has remained dormant since 2017, and the account belonging to Chief Master Sergeant John Bentinvegna of the U.S. Space Force. Security researcher Jane Wong shared her own experience, stating that her Instagram account was taken over without her knowledge. "The password got changed without my knowledge, and I was receiving multiple password reset requests throughout the day," she expressed, noting the unsettling nature of the situation. A video shared on X detailed the method employed by the hacker to compromise accounts. The individual reportedly used a VPN to mask their location, thereby avoiding Instagram's automated security measures. They then engaged with the Meta AI Support Assistant and requested the addition of a new email address to the target's account. The chatbot proceeded to send a verification code to the email provided by the hacker. After receiving the code, the hacker instructed the bot to reset the password, effectively taking control of the victim's account. TechCrunch confirmed the legitimacy of the hacker's public email, which successfully received the verification code as demonstrated in the video. This breach capitalized on the fact that the hacker did not need access to the victim's legitimate email associated with their Instagram account. In response to the growing concerns, Instagram spokesperson Andy Stone acknowledged the issue and confirmed that it has been resolved. However, the scale of the accounts affected remains unclear, as Meta has yet to provide further comments on the matter.