Instagram patches vulnerability allowing account hijacks through Meta AI chatbot

Instagram restored access to several accounts after a flaw allowed hackers to hijack them by manipulating the platform's AI-powered support chatbot. The attack involved directing the chatbot to add a new email address to a target account, receiving a verification code at that address, and then prompting the chatbot to reset the password.

A video posted on X demonstrated the sequence, which used a VPN to avoid location-based protections. Security researcher Jane Wong said her account was taken over in this manner. "The password got changed without my knowledge and I was getting different password reset attempts throughout yesterday," said Wong.

Response and scope On Monday, Instagram spokesperson Andy Stone said the issue had been fixed. It remains unclear how many accounts were affected. The compromised accounts included the inactive handle for the Obama-era White House and the account belonging to the U.S. Space Force's chief master sergeant. Meta did not immediately respond to a request for comment on the incident.