Meta AI chatbot flaw lets hackers hijack Instagram accounts

A security vulnerability in Meta's AI-powered support chatbot was exploited by hackers to gain unauthorized access to a number of Instagram accounts, including several high-profile profiles, over a recent weekend. The company has since resolved the issue and is working to secure affected accounts.

The attack involved hackers tricking the Meta AI Support Assistant into changing the email address associated with a target account and then resetting the password. According to security researchers and videos shared online, the process was straightforward. An attacker would initiate a chat with the support bot, often using a VPN to spoof the presumed location of the account holder to avoid triggering automated security protections. The hacker would then ask the chatbot to add a new email address to the target account. The bot would send a verification code to the hacker's provided email, which the hacker would then share back with the chatbot. This would prompt the bot to display a password reset function, allowing the attacker to take full control of the account.

Crucially, this method did not require the hacker to have any access to the legitimate email or phone number linked to the...