Hackers gained control of high-profile Instagram accounts by simply asking Meta's AI support chatbot to change the email addresses linked to them. The exploit required no advanced technical skills, only a VPN and a few carefully worded requests.
Videos of the technique circulated among Telegram groups for hackers and security researchers, according to 404 Media. The attacks allowed hijackers to take over valuable Instagram accounts and resell them on the gray market for hundreds of thousands of dollars. Meta deployed an emergency patch on May 29 to shut down the vulnerability.
How the Attack Worked
The attackers used a prompt injection method. They first used a VPN to match their location to the target account's region. Then they initiated a password reset process and asked Meta's AI chatbot to change the account's associated email address. The chatbot complied without further verification.
Among the compromised accounts were the official Barack Obama White House Instagram account and the Chief Master Sergeant of the Space Force's account. Both briefly displayed pro-Iranian content before the accounts were restored.
The Aftermath
Meta did not immediately comment on the specifics of the patch. The incident highlights a growing risk as companies integrate large language models into customer support and account recovery systems. These chatbots can be manipulated through carefully crafted prompts, bypassing normal security protocols.
Security researchers have long warned that AI support bots lack the judgment to handle sensitive account changes. The Instagram exploit is one of the most visible examples of that failure.
Why This Matters
The attack affects Instagram users with valuable or verified accounts. Anyone relying on Meta's AI chatbot for account recovery could face similar vulnerabilities if prompt injection attacks are not properly mitigated. The exploit also underscores the broader risk of deploying AI chatbots in security-critical roles without robust safeguards.
For everyday users, the incident serves as a reminder that AI tools can be weaponized in unexpected ways. Companies must test these systems for adversarial attacks before releasing them into production environments.
