Hackers Trick Meta AI Support Chatbot to Seize Instagram Accounts

News outlets and independent security researchers report that attackers persuaded Meta's AI support chatbot to facilitate Instagram account takeovers in early June 2026. Screenshots and videos cited by Reuters, BBC, and Krebs on Security show an attacker using a VPN to spoof location, asking the chatbot to add a new email address to a target account, receiving a verification code sent to the attacker's email, and then using the chatbot's "Reset Password" flow to set a new password. Reuters and TechCrunch report affected profiles including the former White House Instagram account associated with Barack Obama, Sephora, and a senior U.S. Space Force official. Meta spokesperson Andy Stone wrote on X that "the issue that did happen has already been fixed," TechCrunch reported, and Reuters said Meta is securing impacted accounts. Reuters also reported Meta shares fell more than 5% after the episode; security researcher Jane Manchun Wong told Reuters it took about 5 to 10 minutes to reinstate her account.

Reuters and other outlets describe the attack class as a form of prompt injection, where user input manipulates an AI assistant into performing privileged actions without independent identity verification. TechCrunch and security blogs report that the chatbot completed the full account-recovery workflow, sending a verification code to an attacker-controlled email and enabling a password reset, without human intervention or out-of-band confirmation, creating a short, repeatable path to account takeover.

Security researcher Bruce Schneier wrote on Schneier on Security that "LLM chatbots are not trustworthy enough for this application," framing the incident as illustrative of broader trust limits for current generative models handling security-sensitive tasks. Reuters reported investor concern about Meta's AI spending following the episode. Multiple outlets, including 404 Media and Simon Willison's independent security blog, reported that details of the technique circulated in chat and Telegram channels before Meta patched it.

This episode underscores the operational risk of granting conversational agents direct authority over sensitive account operations without strong, verifiable identity checks. Teams building support or account-recovery agents should treat privileged actions (email changes, password resets, MFA disenrollment) as requiring out-of-band confirmation or human escalation regardless of how convincing the conversational request appears, and should log and alert on any agent-initiated recovery flow.

• •Whether Meta publishes a post-incident technical postmortem detailing the exact authorization checks bypassed.
• •How account-recovery and privileged workflows are instrumented for audit logs and human escalation points industry-wide.
• •Whether social-engineering vectors such as location-spoofing and email-verification flows are reworked or rate-limited.
• •Regulatory or platform responses that could mandate stronger multi-factor or out-of-band verification for high-risk account actions on other platforms exposing automated recovery flows to conversational agents.