Meta says hackers hijacked over 20,000 Instagram accounts by exploiting its AI-assisted account recovery chatbot

Meta is notifying at least 20,225 Instagram users that hackers compromised their accounts by exploiting a vulnerability in its AI-assisted account recovery system. The flaw let attackers reset passwords for accounts without two-factor authentication, potentially exposing profile data, contact details, posts, direct messages, and account activity.

The incident highlights how customer-support automation can become a high-risk identity control when connected to account recovery workflows. It also reinforces that two-factor authentication remains a critical safeguard, especially as platforms add AI agents to sensitive security processes.

Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot