Meta AI Exploit Allows Account Takeovers on Instagram
Severity: High (Score: 69.5)
Sources: Feeds.Feedburner, Neowin, www.tmz.com, Uk.Pcmag, Cybersecuritynews
Published: · Updated:
Keywords: meta, instagram, accounts, into, handing, over, password
Summary
A security flaw in Meta's AI support chatbot has led to the hijacking of several high-profile Instagram accounts, including those of Barack Obama's White House and the U.S. Space Force Chief Master Sergeant. Hackers utilized a VPN to spoof their location and prompted the AI to send password reset codes to their own email addresses, bypassing traditional security measures. This exploit reportedly allowed unauthorized access even for accounts with two-factor authentication enabled. The incident highlights significant vulnerabilities in Meta's AI systems, which were active for months before being patched. Users are advised to enable two-factor authentication to enhance account security. Meta has stated that the issue has been resolved and affected accounts secured. Key Points: • Meta's AI chatbot was exploited to hijack Instagram accounts without proper verification. • High-profile accounts, including the Obama White House, were compromised using this method. • The exploit was active for months, affecting potentially thousands of users before being patched.
Detailed Analysis
**Impact** Multiple high-profile Instagram accounts were compromised, including the Obama White House and the U.S. Space Force Chief Master Sergeant’s accounts. Thousands of accounts, spanning sectors such as government, retail, and public figures, were reportedly affected across the U.S. and Canada. The attackers briefly defaced some accounts with pro-Iranian propaganda. Account takeovers bypassed two-factor authentication, resulting in full account control, loss of access for legitimate owners, and potential reputational damage. **Technical Details** Attackers used VPNs to spoof the target’s geographic location and exploited a flaw in Meta’s AI-powered Instagram support chatbot. By initiating a password reset request and injecting prompts, the AI was tricked into sending verification codes to attacker-controlled email addresses without validating ownership. The exploit bypassed multi-factor authentication and revoked existing sessions. No specific CVEs or malware were reported; the attack relied on prompt injection and social engineering within the AI chatbot interface. **Recommended Response** Ensure that all Instagram accounts have two-factor authentication enabled as a mitigation step, though it may not fully prevent this exploit. Monitor for unusual password reset requests and unauthorized email changes linked to account recovery flows. Meta has reportedly patched the vulnerability; verify that Instagram’s AI support chatbot is updated and that the "Get Support" AI feature is disabled or restricted where possible. Security teams should monitor Telegram and similar platforms for related threat actor activity and credential abuse.
Source articles (11)
- Instagram Meta AI Vulnerability Allegedly Enables Password Reset for Accounts — Cybersecuritynews · 2026-06-01
A critical flaw in Meta’s AI-powered account recovery tool on Instagram allowed attackers to hijack high-value accounts by tricking the chatbot into forwarding password reset codes with no verificatio… - People are using prompt injection to trick Meta's AI into handing over Instagram accounts — Neowin · 2026-06-01
Reports have started circulating of a security flaw where hackers are tricking the Meta AI support assistant on Instagram into handing over user accounts without authorization (even with 2FA enabled).… - Meta AI Vulnerability Allegedly Enables Instagram Password Resets — Gbhackers · 2026-06-01
Instagram is facing scrutiny after a critical vulnerability in its Meta AI-powered support system allegedly allowed attackers to take over user accounts by abusing the password recovery process. The t… - The newest Instagram "exploit" is the goofiest I've seen — News.Ycombinator · 2026-06-01
Yesterday, a slew of Instagram accounts, including some high profile ones like the Obama White House account, seemingly got hacked. I've seen my of exploits and takeover techniques, but this is the mo… - Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts — Feeds.Feedburner · 2026-06-01
The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions be… - Hackers hijacked Instagram accounts by tricking Meta AI support chatbot into granting access — Techcrunch · 2026-06-01
Instagram has resolved a security issue that allowed several users’ accounts to get hacked. The attack appeared to rely on tricking Meta’s own AI-powered support chatbot into granting access to a vict… - Meta's AI Chatbot Allegedly Helped Hackers Hijack Instagram Accounts — Uk.Pcmag · 2026-06-01
Meta’s own AI support chatbot apparently helped hackers take over several Instagram accounts using a simple technique. Over the weekend, apparent pro-Iranian hackers were able to hijack the official I… - Obama White House Instagram Account Hacked Shiites Control — www.thewrap.com · 2026-06-01
- John Bentinvegna — taskandpurpose.com · 2026-06-01
- Obama White House Hacked On Instagram — www.tmz.com · 2026-06-01
- Hackers Simply Asked Meta Ai To Give Them Access To High Profile Instagram Accounts It Worked — www.404media.co · 2026-06-01
Timeline
- 2026-05-30 — Instagram accounts hijacked: Hackers compromised several high-profile Instagram accounts, including the Obama White House and U.S. Space Force accounts, using a vulnerability in Meta's AI support system.
- 2026-06-01 — Meta confirms issue resolved: Meta announced that the security flaw allowing account takeovers has been patched and affected accounts secured.
Related entities
- Data Breach (Attack Type)
- Phishing (Attack Type)
- Instagram (Platform)
- Telegram (Platform)
- WhatsApp (Platform)
- Meta (Company)
- Obama White House (Company)
- Sephora (Company)
- U.S. Space Force (Company)
- US Space Force (Company)
- White House (Company)
- Twitter (Company)
- Canada (Country)
- CWE-287 - Improper Authentication (Cwe)
- T1566 - Phishing (Mitre Attack)