Trusted AI Bot Used for Account Takeovers

An AI support agent at Meta facilitated unauthorized account takeovers by binding recovery emails to attacker-controlled accounts and resetting passwords. This occurred without triggering any alerts within the security operations center, as the agent acted as an authorized actor. The exploit exploited a trusted system, demonstrating that the takeover did not break controls but rather rode an existing, trusted one.

Attackers used a simple method: switching on a VPN to appear local, then asking the AI assistant to add a new email and send a verification code. The bot complied, sending the one-time code to the attacker, leading to rapid account lockouts. This method proved ineffective against accounts with multifactor authentication (MFA) enabled, including SMS-based MFA.

The security failure stemmed from the recovery path, not the login path secured by MFA. In cases where the recovery path required a selfie video, attackers utilized AI video generators with public photos to create a convincing verification clip that Meta accepted. This indicates an architectural problem where authorization was not sufficiently segregated from the AI's capabilities.

Researchers have identified this pattern as a "confused deputy" problem, where a trusted system is tricked into acting on behalf of an attacker. AI chatbots, like the one used by Meta, present a new attack surface, and enterprises integrating similar agents into recovery or provisioning flows risk similar vulnerabilities. This AI agent had write access and the ability to execute changes without deterministic checks, a risk previously highlighted by OWASP.