Meta AI exploited to steal Instagram accounts

Meta's new artificial intelligence assistant, designed to streamline customer support for account recovery on Instagram and Facebook, has been found to have a critical security flaw. Researchers discovered that the AI chatbot could be tricked into transferring account ownership to a new email address without proper verification, including multi-factor authentication.

Hackers exploited this vulnerability by using a VPN to spoof their location, making the AI believe they were the legitimate account owner. Once the AI was convinced, it would send an eight-digit code to the hacker's provided email address. Upon entering this code, the hacker would receive a password reset email, granting them full access to the targeted Instagram account.

This security lapse comes amid reports of unusual activity on several high-profile Instagram accounts, including those belonging to former U.S. President Barack Obama and Sephora. Meta has acknowledged the issue, with Communications Vice President Andy Stone confirming on X that the problem has been resolved and affected accounts are being secured. However, the company has not disclosed how many accounts were compromised, though reports suggest users had been flagging the vulnerability since March.