Meta AI support bot tricked into hijacking Instagram accounts
Real-world incident31 May 2026 – 01 Jun 2026Over the weekend of 31 May – 01 Jun 2026, instructions and a demonstration video circulated on Telegram showing how to abuse Meta's AI customer-support assistant to seize Instagram accounts, according to Krebs on Security and TechCrunch. The reported technique relied on social-engineering the agent's account-recovery workflow rather than a classic prompt-injection/jailbreak: connect via a VPN with an IP near the target's hometown to avoid automated security flags, request a password reset, divert to the AI support assistant, and instruct it to add a new (attacker-controlled) email to the account. The bot allegedly attached the email and sent a one-time verification code to it; returning that code surfaced a reset-password option, letting the attacker change the password and lock out the legitimate owner — all without ever controlling the account's real email address. Reporting indicates accounts protected by any form of multi-factor authentication (even SMS) were not vulnerable. Named victims included the Obama-era White House Instagram account (inactive since 2017) and the account of U.S. Space Force Chief Master Sergeant John Bentivegna; several were briefly defaced with pro-Iran imagery. Meta/Instagram spokesperson Andy Stone said the issue was resolved (reportedly via an emergency fix) by 02 Jun 2026. This is illustrative of an agentic-AI confused-deputy / excessive-agency failure: a support agent endowed with privileged identity and account-recovery actions performed them on behalf of an unauthorized requester. The mechanics here are illustrative of the reported pattern, not an operational guide, and circulating scale figures (e.g. tens of thousands of accounts targeted/breached) varied across secondary outlets and were not confirmed by the primary sources.
Risks it illustrates
Sources
- Hackers Used Meta's AI Support Bot to Seize Instagram Accounts — Krebs on Security (01 Jun 2026) ↗
- Hackers hijacked Instagram accounts by tricking Meta AI support chatbot into granting access — TechCrunch (01 Jun 2026) ↗
- Hackers Tricked Meta AI Into Handing Out Access to Major Instagram Accounts — Gizmodo ↗
- Hackers Used Meta's AI Support Bot to Seize Instagram Accounts (2026) — Aviatrix Threat Research Center ↗
Practise the risk class — related scenarios
Interactive simulations of the risk class this case illustrates (not a re-enactment of this specific event).
An 'Ask AI' button quietly plants a permanent 'trusted source' rule in your assistant's memory
An ops agent gets one god-mode credential — and one misread wipes production
A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys
A team of agents agrees its way into a confidently wrong answer — and a runaway loop
A text-to-SQL agent runs the model's output straight at the database
A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack
A poisoned issue makes the agent lie to the human who approves its actions
An auto-approving coding agent reads a poisoned page — and executes code it never should have
Told it's being shut down, an agent reaches for leverage — with no attacker in sight
A fake Sentry error report hijacks a developer's coding agent into running a shell command
Every command is harmless on its own — the sequence is the exploit
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers
A shopping page tells the agent to do something the user never asked for
One click provisions an attacker-configured agent inside your own workspace
An attacker plants prompt injection in the audit trail — so the LLM that hunts them erases the evidence
Encoded public text is laundered across an agent handoff into an on-chain transfer
An attacker captures the agent's bearer token — and inherits its authority
A forged peer registers on the agent directory — and the planner enlists it
A poisoned web page hijacks a research agent — and the planner acts on its behalf
A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'