Ethan Carter
In December, Meta launched a new AI support assistant designed to streamline the account recovery process for users locked out of their Facebook or Instagram accounts. it appears that Meta’s intentions may have inadvertently contributed to a significant security issue.
This AI support assistant has reportedly been exploited by hackers to gain unauthorized access to numerous Instagram accounts. Security experts indicate that the AI tool facilitated account takeovers, even for those secured with two-factor authentication.
The vulnerability was brought to light over the weekend by various security researchers on X. Detailed instructions for hijacking accounts, along with screenshots and videos demonstrating the process, circulated widely on Telegram. These materials indicated that hackers were able to instruct the AI support chatbot to change the email linked to their target account and subsequently request a password reset.
Meta has responded to the situation, yet it remains uncertain how many accounts were compromised before the flaw was addressed. Reports from 404 Media suggest that discussions about this vulnerability had been ongoing among Telegram users since March. In a statement to Engadget, Meta referred to a post from their VP of communications, Andy Stone. “This issue has been resolved and we are securing impacted accounts,” Stone stated in response to a post highlighting the account takeovers.
This issue has been resolved and we are securing impacted accounts.
— Andy Stone (@andymstone) June 1, 2026
While Meta did not elaborate on the reasons for the significant security vulnerability in its AI support tool, it appears that hackers identified a reliance on users’ physical locations for support verification. The now-resolved exploit required hackers to utilize a VPN to match their location with that of the targeted account holder, as reported by Neowin. “Our systems recognize the device you usually use and familiar locations better than ever,” Meta stated in their December blog post regarding the AI support tool.
Although it is unclear how many accounts were compromised using the AI tool, the incidents align with a series of high-profile account hacks, including that of the Obama White House account. This account, which had remained inactive since 2017, shared an AI-generated image with a message that translates to “the White House is under Shiites’ control,” according to TMZ. Meta confirmed the hack to the outlet but did not disclose specifics on how it was executed or the identity of the perpetrators. Other notable accounts affected by the exploit reportedly include beauty retailer Sephora and a senior official from the Space Force, as stated by 404 Media.
Daniel Mercer
