Instagram Meta AI Flaw Let Attackers Hijack High-Value Accounts by Tricking Chatbot Into Sending Password Reset Codes
A logic-layer vulnerability in Instagram's Meta AI account recovery tool allowed attackers to hijack premium short-handle accounts by tricking the chatbot into forwarding password reset codes without any identity verification.
A critical flaw in Meta's AI-powered account recovery tool on Instagram allowed attackers to hijack high-value accounts by tricking the chatbot into forwarding password reset codes with no verification required. Security researchers ZachXBT and Dark Web Informer were among the first to publicly expose the vulnerability, revealing that threat actors had found a way to manipulate Instagram's Meta AI assistant — a tool designed to help users recover access to their accounts.
Attackers engaged the AI chatbot in conversation and prompted it to forward password reset codes to unauthorized parties, entirely bypassing identity verification checks. The flaw stemmed from insufficient controls in how the AI processed account recovery requests, effectively allowing anyone who knew a target's username to initiate the takeover process. The exploit was not a traditional server breach — Meta confirmed no backend systems were compromised. Instead, the vulnerability lived in the AI's logic layer, which lacked proper rate-limiting or authentication enforcement before acting on reset requests.
Attackers deliberately targeted premium, short-handle Instagram accounts, including high-profile usernames such as @hey and @jowo — known in underground markets for their resale value. These coveted accounts, some valued at over $1 million combined, were quickly flipped through private Telegram channels before Meta could intervene. The speed of the operation highlighted how organized and financially motivated threat actors have become in exploiting social media platform vulnerabilities. Dark Web Informer confirmed the sales activity, tracking stolen account listings circulating across Telegram groups in real time — a tactic increasingly common in the account-takeover-as-a-service ecosystem.
Meta moved to patch the vulnerability late Friday after reports surfaced online. In an official statement, the company said: "We fixed an issue that allowed an external party to request password reset emails for some Instagram users. There was no breach of our systems and people's Instagram accounts remain secure." Despite the patch, the incident raised serious questions about the security architecture surrounding AI-assisted support tools and their access to sensitive account recovery functions.
Accounts protected by two-factor authentication (2FA) were not compromised during this attack. Security experts now strongly recommend enabling app-based 2FA (e.g., Google Authenticator or Authy) instead of SMS-based verification, using a private dedicated email not publicly associated with your Instagram profile, avoiding password reuse across platforms, regularly reviewing login activity under Instagram's Security Settings, and storing backup codes securely in case of emergency account recovery.
Meta's hasty patch underscores a growing concern: as AI tools gain deeper access to account management functions, their vulnerability to social engineering becomes a critical attack surface that demands far stricter safeguards. The incident serves as a stark reminder that AI-powered customer support and account recovery features must be designed with robust authentication and rate-limiting controls to prevent abuse.
New reports identify the Obama White House and the U.S. Space Force as specific high-profile victims of this campaign, which saw attackers defacing the accounts with pro-Iranian imagery. Security researchers noted that the exploit was circulated via Telegram and relied on VPN-based location spoofing to deceive the AI assistant, though the attack was reportedly ineffective against accounts protected by multi-factor authentication.
The attack specifically targeted high-value "OG" Instagram handles, dormant institutional accounts, and verified profiles, with compromised usernames appearing on Telegram resale channels almost immediately. Notable victims included the @obamawhitehouse account, which was defaced, and short handles like @hey and @jowo, valued at over $1 million. The vulnerability was described by researchers as a classic "confused deputy" issue, exacerbated by the probabilistic nature of the AI assistant, which could be manipulated with natural language prompts.
The attackers further bypassed Meta's fraud detection by employing VPNs to mimic the target's geographic location. In cases where the AI requested a selfie for verification, threat actors reportedly used AI tools to alter victims' photos before submission. The exploit also inexplicably bypassed two-factor authentication on affected accounts, with some users claiming they received no notification of password reset attempts.
The attackers' method involved tricking Meta's AI into accepting an AI-generated video of a target's face as a selfie for identity verification, a technique that bypassed two-factor authentication. This exploit allowed threat actors to change the associated email address and subsequently reset the password, gaining full account control. Some reports suggest that attackers also used VPNs to mimic the target's usual geographic location, further circumventing security checks.
The exploit technique has evolved, with a new attack now reportedly using a modified Android emulator called BlueStacks to send prompts with hidden characters designed to manipulate the AI. This indicates that while Meta has patched the initial vulnerability, attackers are actively seeking new methods to bypass security controls and exploit the AI's functionalities.
The vulnerability allowed attackers to bypass Instagram's security measures by tricking the Meta AI support chatbot into sending a verification code to a hacker-controlled email address. This code was then used to initiate a password reset, granting the attacker full account access. Meta has since confirmed that this specific exploit has been patched, though the number of affected accounts remains unclear.
Meta's official breach notification reveals that the attackers exploited a vulnerability in the High Touch Support (HTS) AI-assisted account recovery system on April 17, 2026. While the initial report focused on high-value accounts, Meta's filing indicates that 30 accounts in the affected jurisdiction were compromised, with potential access to contact information, dates of birth, and direct messages. The company has since disabled the HTS system and is implementing enhanced authentication checks before its relaunch.
Meta's disclosure to the Maine Attorney General's Office, dated May 31, reveals that the exploitation of its High Touch Support (HTS) tool was discovered on this date. The company has counted users whose passwords were reset via the support tool, lacked 2FA, and whose accounts were likely accessed by hackers, though it acknowledges some legitimate owners may have been mistakenly included in the count. Meta has since disabled the abused tool and invalidated affected password reset links, while also enrolling compromised accounts in a mandatory security checkpoint and resetting their passwords.
The incident, which affected 20,225 Instagram users, occurred due to a bug in Meta's High Touch Support (HTS) AI tool. This flaw allowed threat actors to receive password reset links for accounts they did not own if the rightful owner lacked two-factor authentication. The exposed data included contact information, dates of birth, social media content, direct messages, and profile details.
This new report from Help Net Security provides further details on the Meta AI support system flaw, confirming that attackers exploited a vulnerability in the High Touch Support (HTS) system to initiate password resets for over 20,000 Instagram accounts. The vulnerability allowed attackers to send password reset links to unassociated email addresses, leading to account takeovers if two-factor authentication was not enabled. Meta has since disabled the affected tool and is reviewing similar recovery flows across its platforms.