Meta AI机器人被黑2万个账号，且未验证邮箱
meta的ai支援機器人通過向未驗證的電子郵件發送密碼重置鏈接，劫持了20,225個instagram帳號，暴露了用不穩定自動化取代人工安保的危險。
meta revealed that a vulnerability in its ai-driven instagram support chatbot allowed hackers to hijack up to 20,225 accounts between april and may by exploiting a failure to verify email addresses for password resets. the bug, found in the 'high touch support' recovery tool, bypassed standard security checks, potentially exposing contact info, direct messages, and profile data to attackers. in response, meta disabled the chatbot, invalidated all reset links generated during the period, and instituted a mandatory password reset for affected users while auditing similar systems across its platforms. this incident exposes a critical fragility in automating security infrastructure with ai, as meta relied on this tool while simultaneously laying off human support staff.