Meta Patches Instagram Support Flaw After Phishers Target High-Profile Accounts

Instagram has restored access to several accounts after hackers exploited a Meta AI support chatbot to add unauthorized email addresses and reset passwords. The company said the issue was fixed within days of being identified.

Meta spokesperson Andy Stone said on Monday that the flaw had been addressed. The vulnerability allowed attackers to contact the Instagram AI support assistant, request the addition of an external email address they controlled, and have the chatbot send a verification code to that address.

The attacker could then relay the code back to the chatbot, after which it would offer a password reset option.

Security researcher Jane Wong reported that her own account was compromised using this method. "The password got changed without my knowledge and I was getting different password reset attempts throughout yesterday," Wong said. "Quite concerning."

A video demonstration posted on X showed the sequence, which included the use of a VPN. TechCrunch verified that the public mailbox shown in the demonstration received the verification code sent by the chatbot.

Accounts affected included the inactive handle associated with the Obama-era White House and the account belonging to the U.S. Space Force's chief master sergeant. It remains unclear how many accounts were impacted overall. Meta did not immediately respond to a request for comment on the number of accounts affected or other details of the incident.

The flaw involved a customer support flow that is rarely used. Instagram restored access to the compromised accounts after the issue was reported.