Case meta-ai-support-instagramAgent hijackWorldwide
Hackers trick Meta's AI support chatbot into handing over Instagram accounts
Attackers asked Meta's AI support assistant to link new emails to target accounts, then reset passwords, hijacking high-profile accounts before Meta fixed the flow.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 8, 2026
- Location
- Worldwide
- Target
- Meta AI account-recovery assistant / Instagram
- Severity
- High
- Triggered by
- Account-hijacking crews coordinating on Telegram
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Attackers asked Meta's AI support assistant to link new emails to target accounts, then reset passwords, hijacking high-profile accounts before Meta fixed the flow.
Impact: Unknown number of Instagram accounts hijacked, including high-profile ones used to post propaganda; 2FA-protected accounts received reset prompts but were largely not taken over
Who triggered it
Actor: Account-hijacking crews coordinating on Telegram
Attribution: Reported by 404 Media from Telegram chat logs; Meta confirmed and fixed the issue but did not attribute
Motive: Resale of short or high-value Instagram usernames; propaganda posts from hijacked accounts
How it happened
Attack vector: Attackers used a VPN to match the victim's region, then asked the AI support assistant to link a new email to the target account and used the reset code to change the password
Root cause: AI recovery assistant could change account email with no human review and weak identity verification beyond approximate location
Timeline
- Meta launches AI support assistant; Telegram users begin abusing it
- Meta reportedly applies emergency patch after high-profile takeovers
- 404 Media reports hijacks of accounts tied to Obama, Sephora and a Space Force chief
- Meta says the issue is resolved and impacted accounts are being secured
Response
Meta closed the loophole, said impacted accounts were being secured; no explanation of the flaw's cause
Current status: Patched
Sources (open in a new tab)
- Engadget engadget.com
- TechSpot techspot.com
- heise heise.de
- Silicon UK silicon.co.uk
Cite this case
Hackers trick Meta's AI support chatbot into handing over Instagram accounts. AI Threat Watch, case meta-ai-support-instagram, Jun 8, 2026. https://aithreat.io/cases/meta-ai-support-instagram/
Permanent link: https://aithreat.io/cases/meta-ai-support-instagram/