Meta AI support chatbot gave hackers access to notable Instagram accounts

Meta’s AI support chatbot has come under fire after it was discovered that hackers exploited its functionalities to gain unauthorized access to high-profile Instagram accounts. Reports indicate that these cybercriminals managed to change email addresses linked to various notable accounts by simply using a VPN to mask their real locations. This method has been depicted as alarmingly simple in videos circulating within hacker and security researcher communities on platforms like Telegram. The exploit was particularly concerning as it allowed the hackers to take control of valuable Instagram accounts, some worth hundreds of thousands of dollars, and resell them on the gray market. This situation escalated significantly until Meta deployed an emergency fix on May 29. Notably, accounts such as the Barack Obama White House account and the Chief Master Sergeant of the Space Force were compromised, showcasing the potential reach of this security flaw. To execute the attack, hackers needed to align their VPN location with that of the targeted account, initiate a password reset, and then instruct the AI support chatbot to update the email address. This straightforward prompt injection tactic has reportedly been active since at least February, with thousands of accounts falling victim to the breach. However, it drew increased attention following the compromise of several high-profile accounts. Prominent figures in cybersecurity, including researcher Jane Manchun Wong, have also shared experiences of their accounts being hacked. On May 31, ZachXBT, a pseudonymous intelligence researcher, criticized the AI support system on social media, highlighting its excessive permissions that allowed for password resets without two-factor authentication, and raising concerns about identity verification. Simultaneously, another researcher known as Dark Web Informer detailed the same exploit, confirming that it had recently been patched.