Meta的AI代理將Instagram的鑰匙交給了黑客——它真的有那麼蠢嗎
駭客通過欺騙meta的客服ai劫持了instagram帳戶，繞過安全措施更改電子郵件地址。這暴露了那些優先考慮任務完成而非安全協議的ai代理中存在的關鍵漏洞。
404 media revealed that attackers successfully hijacked instagram accounts by instructing meta's ai customer support agent to link profiles to attacker-controlled emails, bypassing standard security checks. one attacker utilized this access to post pro-iran content on a dormant obama white house account, while others targeted valuable single-word usernames for potential resale. the exploit's simplicity—relying only on a vpn to spoof location and a direct prompt to the agent—has shocked researchers like neil gong, who noted that basic red-teaming should have identified this vulnerability before deployment. this breach illustrates a systemic risk for ai agents: their 'eagerness' to complete tasks without human-like suspicion makes them susceptible to manipulation, necessitating strict software-based guardrails rather than relying on model alignment alone.