Hackers claim to have tricked Meta’s AI chatbot to gain access to several popular Instagram accounts.
A number of high-profile Instagram accounts have been compromised in the past few days, including the former White House account from the Obama administration, which still has over 2.4 million followers, the account belonging to the Chief Master Sergeant of the US Space Force, and beauty brand Sephora’s account.
Online cybersecurity researchers have alleged that the hackers gained access to these accounts by exploiting Meta’s AI-powered support chatbot. Telegram groups for cybersecurity researchers have been sharing videos that appear to show how hackers may have been able to take control of these accounts.
One video shows a hacker asking Meta AI chatbot to reset a targeted Instagram account’s password using a “password reset email” and instructing it to send the verification code to change the password to a new email address.
When Meta’s AI chatbot asked hackers to verify their identity with a selfie video, they were allegedly able to present a fake one generated using AI tools.
Once verified, the hackers could change the verification email address to theirs.
Cybersecurity researchers compared this strategy with “social engineering” methods – scams involving tricking people into giving away sensitive information – to exploit AI chatbots.
The hack seems to have bypassed two-factor authentication measures designed to protect against such requests.
Meta did not immediately respond to The Independent’s request for comment, but appeared to acknowledge the vulnerability.
“This issue has been resolved, and we are securing impacted accounts,” Meta’s head of communications Andy Stone posted on X on Monday.
It remains unclear how many Instagram accounts were hacked this way.
The issue raises concerns about social media platforms shifting key tasks traditionally handled by human support staff to AI chatbots. In March, Meta rolled out AI-powered support for all Facebook and Instagram accounts, saying the chatbots would help users reset passwords and carry out other account maintenance functions.
“When something goes wrong with your account, you shouldn’t have to hunt for answers. The Meta AI support assistant helps you understand what’s happening, what you can do next and can even take action for you,” the feature’s product page says.
“Unlike traditional help centres that just point you to articles, this assistant can actually help you take action – from resetting your password to reporting problematic content,” it says.
Users whose accounts were compromised complained on social media that there appeared to be no way to escalate account-related problems to a human.
