instagram2 articles
Meta's AI Support Tool Had a Bug. Hackers Found It First.
Meta disclosed that approximately 20,000 Instagram accounts were compromised through a bug in its High Touch Support (HTS) account recovery tool, which failed to verify that the email address provided during a password reset request matched the one associated with the targeted account. This allowed attackers to redirect password reset links to their own email addresses and take over accounts that lacked two-factor authentication (2FA). Meta has since disabled the vulnerable tool, invalidated the exploited reset links, reset affected account passwords, and plans to notify impacted users.
Meta's AI Assistant Handed Hackers the Keys to High-Profile Instagram Accounts
Hackers exploited a "confused deputy" logic flaw in Meta's AI-powered account recovery assistant to take over hundreds of high-profile Instagram accounts, including those of the Obama White House, Sephora, and a senior Space Force official. By simply asking the chatbot to link a new email address to targeted accounts, using VPNs to spoof locations and AI-altered photos to bypass identity checks, attackers were able to reset passwords and circumvent two-factor authentication without alerting victims. Meta has since patched the vulnerability, but the incident highlights the critical risk of granting AI agents broad system access without robust authorization controls.