MetaのAIボットが20kアカウントをハッキング — メール確認もしていなかった
MetaのAIサポートボットが、未認証のアドレスにパスワードリセットリンクをメールで送信することで20,225件のInstagramアカウントを乗っ取り、バグだらけの自動化で人間によるセキュリティを置き換える危険性を露呈しました。
meta revealed that a vulnerability in its ai-driven instagram support chatbot allowed hackers to hijack up to 20,225 accounts between april and may by exploiting a failure to verify email addresses for password resets. the bug, found in the 'high touch support' recovery tool, bypassed standard security checks, potentially exposing contact info, direct messages, and profile data to attackers. in response, meta disabled the chatbot, invalidated all reset links generated during the period, and instituted a mandatory password reset for affected users while auditing similar systems across its platforms. this incident exposes a critical fragility in automating security infrastructure with ai, as meta relied on this tool while simultaneously laying off human support staff.