Meta的AI代理将Instagram的钥匙交给了黑客——它真的有那么蠢吗
黑客通过欺骗meta的客服ai劫持了instagram账户，绕过安全措施更改电子邮件地址。这暴露了那些优先考虑任务完成而非安全协议的ai代理中存在的关键漏洞。
404 media revealed that attackers successfully hijacked instagram accounts by instructing meta's ai customer support agent to link profiles to attacker-controlled emails, bypassing standard security checks. one attacker utilized this access to post pro-iran content on a dormant obama white house account, while others targeted valuable single-word usernames for potential resale. the exploit's simplicity—relying only on a vpn to spoof location and a direct prompt to the agent—has shocked researchers like neil gong, who noted that basic red-teaming should have identified this vulnerability before deployment. this breach illustrates a systemic risk for ai agents: their 'eagerness' to complete tasks without human-like suspicion makes them susceptible to manipulation, necessitating strict software-based guardrails rather than relying on model alignment alone.