Instagram users locked out after Meta AI abused to steal accounts
Instagram accounts were compromised due to attackers exploiting Meta’s AI-powered support tools to impersonate legitimate owners. Users were tricked into verifying their identities via AI-generated selfies, bypassing traditional security measures like 2FA. The lack of human intervention within Meta’s automated support system exacerbated the issue, leaving affected users unable to recover their accounts.
Multiple high-value Instagram accounts, including those previously used by the Obama White House team and app researcher Jane Manchun Wong, were targeted in a coordinated attack. Attackers leveraged Meta’s AI assistant to convince it of their ownership, leading to the successful alteration of account email addresses and subsequent takeover. The process involved tricking the AI into accepting AI-generated selfies as authentic, bypassing 2FA protections. The lack of human oversight within Meta’s support system created a critical vulnerability, trapping users in endless chatbot loops with no escalation path.