Hackers exploit Meta AI support chatbot to hijack Instagram accounts

Instagram has resolved a security issue that allowed several users accounts to get hacked. The attack involved tricking Metas AI-powered support chatbot into granting access to a victims account. Several users reported on Reddit and on X that their Instagram accounts were compromised over the weekend. The affected accounts included the Instagram handle for the Obama-era White House, which has been inactive since 2017, and the account of U.S. Space Force chief master sergeant John Bentivegna. Security researcher Jane Wong said her Instagram account was also taken over. Wong said the password got changed without her knowledge and she received different password reset attempts throughout the previous day. A video posted on X showed the step-by-step process. The hacker used a VPN to spoof the targets presumed location and opened a chat with the Meta AI Support Assistant to request addition of a new email address to the target account. The chatbot sent a verification code to the email address supplied by the hacker. The hacker shared the code with the chatbot, which then displayed a button to reset the password. The hacker entered a new password and gained control of the account. TechCrunch verified that the hackers public email mailbox received the verification code. The attack did not require the hacker to take over the legitimate email address linked to the victims Instagram account. Instagram spokesperson Andy Stone said Monday in replies to posts about the issue that it has been fixed. It is unclear how many Instagram users had their accounts accessed improperly. Meta did not immediately respond to a request for comment.