Meta says it fixed an AI support flaw used to take over Instagram accounts

Monday, June 1, 2026Technology & SocietyWell-covered3 frames

Meta said it fixed a security flaw in its AI-powered support assistant after attackers used it to hijack Instagram accounts.
The reported method involved getting Meta's support chatbot to link an attacker-controlled email address to a target Instagram account and then using password reset tools to take control of the account.
Multiple high-profile Instagram accounts were reported as affected, including the Obama-era White House account, Sephora, and the U.S. Space Force chief master sergeant's account.
Users on Reddit and X reported a wave of account hijackings over the weekend, indicating the issue was not limited to a few prominent accounts.
Several reports said attackers did not need prior access to a victim's email account to carry out the takeover.
Videos and screenshots showing the technique circulated on social platforms and messaging channels, helping expose how the chatbot could be used in account takeovers.
What remains unresolved is the full scale of the incident: reports say multiple accounts were affected, but the total number has not been clearly established in Meta's public statements cited by these outlets.

How left and right are reading this

Both agree: A support tool meant to help users instead became a path to account takeover, exposing a real security failure that left people and institutions vulnerable while Meta has yet to clarify how widely the flaw was exploited.
They split on: Less a disagreement than a question of emphasis: the harm borne by users caught in a wider wave of hijackings, versus the governance failure of letting automated support change recovery details without tighter security bounds.

Meta said it fixed a security flaw in its AI-powered support assistant after attackers used it to hijack Instagram accounts.
The reported method involved getting Meta's support chatbot to link an attacker-controlled email address to a target Instagram account and then using password reset tools to take control of the account.
Multiple high-profile Instagram accounts were reported as affected, including the Obama-era White House account, Sephora, and the U.S. Space Force chief master sergeant's account.
Users on Reddit and X reported a wave of account hijackings over the weekend, indicating the issue was not limited to a few prominent accounts.
Several reports said attackers did not need prior access to a victim's email account to carry out the takeover.
Videos and screenshots showing the technique circulated on social platforms and messaging channels, helping expose how the chatbot could be used in account takeovers.
What remains unresolved is the full scale of the incident: reports say multiple accounts were affected, but the total number has not been clearly established in Meta's public statements cited by these outlets.