Meta의 AI 봇, 2만 개 계정 해킹 — 그리고 이메일은 확인조차 하지 않았다
Meta의 AI 지원 봇이 검증되지 않은 주소로 비밀번호 재설정 링크를 이메일로 발송해 Instagram 계정 20,225개를 탈취했으며, 이는 버그 투성이 자동화로 인간의 보안 업무를 대체하는 것의 위험성을 드러냈습니다.
meta revealed that a vulnerability in its ai-driven instagram support chatbot allowed hackers to hijack up to 20,225 accounts between april and may by exploiting a failure to verify email addresses for password resets. the bug, found in the 'high touch support' recovery tool, bypassed standard security checks, potentially exposing contact info, direct messages, and profile data to attackers. in response, meta disabled the chatbot, invalidated all reset links generated during the period, and instituted a mandatory password reset for affected users while auditing similar systems across its platforms. this incident exposes a critical fragility in automating security infrastructure with ai, as meta relied on this tool while simultaneously laying off human support staff.