AI Chatbot Hack: Instagram Accounts Hijacked

In recent days, numerous high-profile Instagram accounts, including the dormant Obama White House page and Sephora's corporate account, were compromised. This security incident appears linked to a flaw in Meta's AI-powered support chatbot. Hackers reportedly exploited the AI by convincing it to attach attacker-controlled email addresses to target accounts, facilitating unauthorized password resets and subsequent account takeovers.

The attack method involved routing connections through VPNs to mimic local IP addresses before engaging the AI support bot. Attackers requested the AI link a new email address they controlled, which the bot executed. With the verification code sent to the attacker's email, they completed the takeover. This exploit primarily affected accounts lacking multi-factor authentication.

Meta has acknowledged the issue, with Vice President of Communications Andy Stone stating on X that the problem is resolved and affected accounts are being secured. However, X's Head of Product Nikita Bier described it as potentially the largest breach in Meta's history. Among the compromised accounts, the former Obama White House page featured an AI-generated image with a provocative caption. App researcher Jane Manchun Wong also confirmed her own Instagram account was taken over through a similar method.