Meta AI Support Bot Reportedly Enabled Takeovers of High-Profile Instagram Accounts

Hackers reportedly used Meta's AI support chatbot to take over high-profile Instagram accounts by allegedly convincing it to change account email information and trigger recovery flows. Reported targets included the Barack Obama White House account; the account of John F. Bentivegna, the Chief Master Sergeant of the Space Force; Sephora's account; and app researcher Jane Manchun Wong. Meta said the issue had been resolved.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident involved security vulnerabilities in Meta's AI support chatbot that were exploited by hackers to gain unauthorized access to high-profile Instagram accounts.

Additional risk subdomains

• 5.1 Overreliance and unsafe use: Meta offloaded critical account security and recovery functions to an AI chatbot without providing a reliable human escalation path, leading to unsafe deployment.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The incident was caused by the Meta AI support chatbot making the decision to change account email addresses without proper verification, which was an unexpected and unintentional outcome of its deployment.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is an AI chatbot used for customer support and account maintenance, which falls under the category of chatbots requiring transparency and basic safety measures.

AI system and alleged parties

• AI system: Meta's AI support chatbot (Meta)
• AI purpose: Chatbot; Automatic Fault Handling
• Behaviour type: Assistant
• Alleged developer: Meta, Large language model developers, Chatbot developers
• Alleged deployer: Meta, Instagram, hackers
• Alleged harmed parties: Sephora, Privacy, Meta users, John F. Bentivegna, Jane Manchun Wong, Instagram users, Barack Obama White House Instagram account, Barack Obama

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes unauthorized access to personal and organizational Instagram accounts by changing associated email addresses.

Directly caused: Attackers gained full access to the private data, messages, and account controls of high-profile users, including Jane Manchun Wong and official organization accounts.

Inferred additional harm: It is highly likely that hackers accessed private direct messages, personal information, and linked account details of all hijacked profiles.

People affected

• Occurrences reported: 1
• People reportedly harmed: 4
• People reportedly exposed: 100

Potential causes

Management

• Prioritizing Automation Over Safety: Meta rushed AI support deployment to offload critical functions.
• Inadequate Incident Response: Slow response to exploit that was active for months before patch.

Technology

• Vulnerable AI Support Bot: AI bot changed account email addresses without proper verification.
• Weak Verification Logic: Bot sent verification code to the new attacker email instead of old one.
• Inadequate VPN Detection: System failed to detect or block location spoofing via VPN.

Data Inputs

• Spoofed Location Data: Attackers used VPNs to spoof location and bypass geographic security.
• Target Username Lists: Lists of high-value targets and locations aided the exploit.

Human Factors

• No Human Escalation Path: Victims had no way to reach human support to report takeovers.
• Social Engineering of AI: Attackers manipulated conversational AI to bypass security controls.

Process and Methods

• Flawed Password Reset Process: Allowed email changes during reset process via automated chat.
• Inadequate Risk Assessment: Meta deployed automated account recovery without sufficient testing.

Information quality

• Classification confidence: High
• Reason for confidence: The report from 404 Media provides clear, detailed, and actionable information regarding the exploit mechanism, the specific accounts affected, and Meta's response. The steps of the exploit are documented with evidence from Telegram channels, and Meta's confirmation of the patch adds high credibility.
• Ambiguities identified: The exact number of total hijacked accounts is not fully quantified, and the specific actions taken by hackers once inside the accounts are not detailed.
• Alternative interpretations: None. The incident is a straightforward security exploit of an AI-driven support system.

Hackers successfully exploited Meta's autonomous AI support chatbot to hijack high-profile Instagram accounts, including US government and military profiles. While quickly patched, the incident highlights critical security vulnerabilities in deploying autonomous AI agents for sensitive administrative functions without human oversight, posing risks to official communications.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Immediate. The exploit was actively occurring and required urgent mitigation, with Meta deploying a security patch within 24 hours of public exposure.
• Autonomy: Full autonomy. The AI chatbot made the decision and executed the account email changes autonomously without requiring human administrator verification or oversight.
• Novelty: Evolved capability. Represents an evolved capability where traditional social engineering and support-abuse tactics are adapted to target autonomous AI system logic.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety mechanisms were targeted or impacted by this digital exploit.
• Information security: Substantial. The hijacking of high-profile accounts, including the Barack Obama White House and Space Force accounts, presents a substantial risk of information warfare and unauthorized dissemination of sensitive information.
• Sovereignty: Substantial. Compromise of official US government and military communication channels directly impacts the integrity of official public communications, though quickly resolved.
• Economic security: Minor. Disrupted commercial accounts like Sephora and created a black market for high-value usernames, but posed no systemic threat to national economic or technological security.
• Societal stability: Minor. Violated privacy rights of targeted individuals and organizations, but did not cause widespread societal instability or systematic human rights abuses.