{"id":467285,"date":"2026-06-08T20:02:08","date_gmt":"2026-06-08T20:02:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/467285\/"},"modified":"2026-06-08T20:02:08","modified_gmt":"2026-06-08T20:02:08","slug":"meta-says-thousands-of-instagram-accounts-were-breached-through-its-ai-support-assistant","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/467285\/","title":{"rendered":"Meta Says Thousands of Instagram Accounts Were Breached Through Its AI Support Assistant"},"content":{"rendered":"

Meta has finally put a number on how many Instagram accounts were breached after hackers tricked its AI-powered support chatbot into helping them take over accounts.<\/p>\n

The social media company filed a data breach notice<\/a> with Maine\u2019s attorney general\u2019s office on Friday, stating that 20,225 people were affected. According to the filing, the breach began on April 17 and was discovered on May 31.<\/p>\n

Several outlets reported last week that hackers were able to convince Meta\u2019s AI support chatbot to link email addresses they controlled to Instagram accounts they did not own. That allowed the hackers to reset passwords and take over the accounts<\/a>.<\/p>\n

404 Media reported<\/a> that the attacks coincided with the hacking of a number of high-profile Instagram account, including the Barack Obama White House account, the account of the Chief Master Sergeant of the U.S. Space Force, and the account the makeup company Sephora.<\/p>\n

The breaches come amid growing concern that AI could make cyberattacks faster and easier. Google recently said hackers used AI to help discover a zero-day<\/a> vulnerability, the Pentagon is reportedly exploring weaponizing cyber-capable AI models<\/a>, and researchers have warned that AI-powered worms<\/a> could spread with little human involvement. But the Instagram attacks show the risk can be much simpler.\u00a0<\/p>\n

Meta announced<\/a> its AI support assistant in March, saying it would help users sort out account issues like password resets.<\/p>\n

According to earlier reports, hackers used VPNs to make it look like they were in the same country as the accounts they were targeting. They then initiated a password reset and asked to chat with Meta\u2019s AI support assistant. From there, they asked the assistant to link their own email address to the target\u2019s account.<\/p>\n

The AI assistant would then send a password reset link to the attacker\u2019s email. The attacker could use that link to finish the password reset and gain access to the account. It\u2019s worth noting that the attack only appears to have worked on accounts that did not have two-factor authentication enabled.<\/p>\n

\u201cThe tool itself worked properly and functioned as intended; however due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user\u2019s Instagram account,\u201d Meta wrote in the notice to Maine\u2019s attorney general.<\/p>\n

According to the notice, Meta said it is unaware of what personal information, if any, was actually accessed. But the company said attackers may have been able to access information like contact information, dates of birth, profile information, direct messages, account history, and information from connected accounts or linked services.<\/p>\n

\u201cWe fixed this issue, secured impacted accounts and restored individuals\u2019 access. Some of our internal backend checks failed in this instance, but it wasn\u2019t due to the AI agent itself, and we\u2019ve addressed the underlying cause. Consistent with our obligations, we\u2019re notifying regulators of the issue and will also formally notify potentially affected individuals,\u201d a Meta spokesperson told Gizmodo in emailed statement.<\/p>\n

The company added, in the breach notice, that on the same day the breach was identified the company disabled the AI-assissted support tool, removed the vulnerable code path, and invalidated existing password reset links.<\/p>\n

The company also said it is conducting a review of similar account recovery flows across Meta platforms to look for and fix similar vulnerablities.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"Meta has finally put a number on how many Instagram accounts were breached after hackers tricked its AI-powered…\n","protected":false},"author":2,"featured_media":467286,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[365,363,364,1510,898,111,139,69,145],"class_list":["post-467285","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-cybersecurity","tag-meta","tag-new-zealand","tag-newzealand","tag-nz","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/467285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=467285"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/467285\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/467286"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=467285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=467285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=467285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}