Meta's AI support tool abused to hijack 20,000 Instagram accounts
Attackers abused Meta's AI-assisted account recovery tool, which failed to check that the reset email matched the account, to take over 20,225 Instagram accounts without two-factor authentication. Meta disclosed the incident in a breach notice and says affected accounts were secured.
- Disclosed
- Jun 2026
- Organization
- Meta (Instagram)
- Vendor
- Meta
- Product
- Meta AI support assistant
- Kind of AI
- AI app
- AI's role
- AI was the way in
- How it happened
- Leaky AI product: App flaw
- Harm
- Data exposed
- Data involved
- Personal data
- Reach
- One organization
- Records
- 20,225
- Severity
- Medium
- Model at fault
- No
- Status
- Confirmed