Meta's AI bot hacked 20k accounts — and it wasn't checking emails
meta's ai support bot hijacked 20,225 instagram accounts by emailing password reset links to unverified addresses, exposing the danger of replacing human security with buggy automation.
meta revealed that a vulnerability in its ai-driven instagram support chatbot allowed hackers to hijack up to 20,225 accounts between april and may by exploiting a failure to verify email addresses for password resets. the bug, found in the 'high touch support' recovery tool, bypassed standard security checks, potentially exposing contact info, direct messages, and profile data to attackers. in response, meta disabled the chatbot, invalidated all reset links generated during the period, and instituted a mandatory password reset for affected users while auditing similar systems across its platforms. this incident exposes a critical fragility in automating security infrastructure with ai, as meta relied on this tool while simultaneously laying off human support staff.