Hackers talked Meta's AI support bot into resetting Instagram passwords
Hackers took over Instagram accounts by getting Meta's AI support assistant to add their own email address and issue a password reset. The attackers say the trick failed on every account with multi-factor authentication, so the exposed accounts were the ones protected by a password alone.
Not a builder's beat, but builders have a standing stake in it.
Accounts with MFA: hackers said the exploit failed on all of them. SMS-code MFA likely would have blocked it, per Krebs on Security. Compromised: the Obama-era White House and Space Force chief master sergeant accounts. Meta's Andy Stone said the issue was resolved.
- What it limits constraint Accounts with MFA, per hackers The hackers who released the video said their exploit failed against any account that had MFA enabled., claim 12
- What's now possible capability SMS-code MFA users Even Instagram's least robust MFA, a one-time code by SMS, likely would have blocked the exploit, Krebs on Security said., claim 13
- Who's exposed exposure Obama White House, Space Force Listed among compromised accounts: the Obama-era White House handle and chief master sergeant John Bentivegna's., claim 2
- Who has to decide decision Meta Andy Stone said on Twitter/X the issue had been resolved and that impacted accounts were being secured., claim 14
| Who | How | Kind | Claim |
|---|---|---|---|
| Accounts with MFA, per hackers | The hackers who released the video said their exploit failed against any account that had MFA enabled. | constraint | 12 |
| SMS-code MFA users | Even Instagram's least robust MFA, a one-time code by SMS, likely would have blocked the exploit, Krebs on Security said. | capability | 13 |
| Obama White House, Space Force | Listed among compromised accounts: the Obama-era White House handle and chief master sergeant John Bentivegna's. | exposure | 2 |
| Meta | Andy Stone said on Twitter/X the issue had been resolved and that impacted accounts were being secured. | decision | 14 |
What happened
- Instructions began spreading on several Telegram channels on May 31, along with a video from pro-Iran hackers that claimed to show the exploit step by step.
- Using a VPN to look local, the attacker asked the bot to add a new email, gave it the code it sent there, and the bot then offered a Reset Password button.
- The Obama White House account and the account of the Space Force's chief master sergeant were briefly defaced with pro-Iranian images and messages.
- Meta's Andy Stone said the issue had been resolved and that impacted accounts were being secured.
- The group claimed the short account names it hijacked have a resale value of more than half a million dollars.
Why it matters
- Who has to decide decision Any platform running account recovery through an AI bot now has to decide which actions the bot may take alone, because a code sent to an address the requester chose proves nothing about ownership.
- What it costs cost If Meta takes away the bot's power to relink email, legitimate users go back to a recovery process that Cybersecguru said can take weeks of back-and-forth.
- What it sets up precedent Copying this attack costs little. The steps were posted on open Telegram channels, and Goldin expects more attacks on chatbots that handle recovery.
The one-time code in that flow proved only that the attacker controlled their own mailbox. TechCrunch confirmed that the public mailbox shown in the video received it [7]. The hacker never had to take over the email address already linked to the victim's account [8]. The VPN step put the attacker's IP address in or near the target's usual hometown [6], to avoid triggering Instagram's automated account protections [5].
The bot had that authority by design. "Meta's solution was to deploy a conversational AI layer to handle common recovery workflows: relinking a lost email address, triggering a password reset, verifying account ownership," Cybersecguru wrote [9]. In our view, one chat agent both verified ownership and carried out the actions that verification unlocked, so a single conversation could finish the takeover.
Ian Goldin, a threat researcher at Lumen's Black Lotus Labs, said AI bots are as eager to help and as open to trickery as human support staff who get social engineered into handing over accounts [10]. "AI chatbots create interesting new attack surface, and we're likely going to see a lot more of these kinds of attacks," Goldin said [11].
The cheapest defence was enough. Krebs wrote that even an SMS one-time code, the least robust MFA Instagram offers, likely would have blocked the exploit [13].
Some of this is confirmed and some is only reported. Meta did not immediately respond to TechCrunch's request for comment [16]. Cybersecguru reported that Meta pushed an emergency patch over the weekend and that no back end database was breached [15]. According to TechCrunch, it is unclear how many Instagram users had their accounts improperly accessed [17].
What to watch
- Whether Meta says how many accounts the bot handed over, and whether the bot gets back its power to relink email addresses.
- The same add-a-new-email request tried against AI recovery assistants at other large platforms, the kind of follow-on attack Goldin expects.
- Any sale of the short Instagram handles the pro-Iran group says it took.
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Hackers hijacked Instagram accounts by tricking Meta's AI-powered support chatbot into granting access to victims' accounts.
- [2]
Compromised accounts include the Instagram handle for the Obama-era White House and the account of U.S. Space Force chief master sergeant John Bentivegna.
- [3]
The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend.
- [4]
On May 31, word began to spread on several Telegram channels that Meta's AI bot would add an email address to an existing account as part of its standard password reset flow; a video released on Telegram by pro-Iran hackers claimed to document the exploit.
- [5]
Per the video, the hacker used a VPN to spoof the target's presumed location to avoid triggering Instagram's automated account protections, opened a chat with Meta AI Support Assistant, asked it to add a new email address, received a verification code at that address, shared it with the chatbot, and was shown a 'Reset Password' button to set a new password.
- [6]
The exploit appears to have involved using a VPN connection with an IP address in or near the target's usual hometown.
- [7]
TechCrunch verified that the hacker's public email mailbox displayed in the video received the verification code.
- [8]
At no point did the hacker have to take over the legitimate email address linked to the victim's Instagram account.
- [9]
"Meta's solution was to deploy a conversational AI layer to handle common recovery workflows: relinking a lost email address, triggering a password reset, verifying account ownership," Cybersecguru wrote.
- [10]
Ian Goldin, a threat researcher at Lumen's Black Lotus Labs, said that just as human customer support employees can be social engineered into providing unauthorized account access, AI bots are equally eager to help and vulnerable to persuasion and trickery.
- [11]
"AI chatbots create interesting new attack surface, and we're likely going to see a lot more of these kinds of attacks," Goldin said.
- [12]
The hackers who released the video said their exploit failed to work against any accounts that had MFA enabled.
- [13]
Even the least robust form of MFA Instagram offers, a one-time code sent via SMS, likely would have blocked the exploit.
- [14]
Meta's Andy Stone said on Twitter/X that the issue had been resolved and that they were securing impacted accounts.
- [15]
The security blog thecybersecguru.com reports that Meta pushed an emergency patch over the weekend and clarified that no back end database was breached.
- [16]
Meta did not immediately respond to TechCrunch's request for comment.
- [17]
It is unclear how many Instagram users had their accounts improperly accessed.
- [18]
The Telegram account that posted the video said hackers used the exploit to hijack valuable short Instagram account names that allegedly have a resale value of more than half a million dollars.
- [19]
Cybersecguru wrote that recovering a locked Instagram account, especially a high-value one, can take weeks of back-and-forth with an automated ticketing system.
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- krebsonsecurity.comJun 1Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts – Krebs on Security