Hackers took over famous Instagram accounts by tricking Meta’s AI support chatbot. The AI let them change account details without checking who they really were.
This shows a big problem. Meta is trying to use AI to handle sensitive account tasks, but without enough human oversight. Here’s how the exploit worked and the steps you need to take to secure your profile.
How to Steal an Account with Just a Text
In late May 2026, several major Instagram accounts were hacked, like those of the Obama White House page, Sephora, and military officials. Surprisingly, the hackers didn’t use complex tricks. They just fooled Meta’s AI support chatbot.
They used a VPN to fake the owner’s location, making the system think the login was real. Then they acted like normal users who forgot their passwords. The AI, built to be fast and helpful, fell for it. It never checked who it was talking to. This let hackers add their own email and send themselves the verification codes. By trusting the request blindly, the AI skipped all the security checks that should have stopped them.
The Anatomy of an AI-Driven Takeover
The exploit succeeded because the chatbot possessed elevated permissions, enabling it to change important account settings without checking who the requester was. The attack unfolded as follows:
- Spoofing: Attackers used a VPN to mimic the victim’s location and quiet those geolocation warnings.
- Support Access: They selected “Forgot Password” and “Get Support” to start a direct chat with Meta’s AI assistant.
- Impersonation: Attackers lied to the AI, saying they were the real account owners. This way, they asked for a switch to an email address under their control.
- OTP Bypass: The AI blindly sent a one-time passcode to the hacker’s email. The AI treated this recovery request as a high-privilege event, effectively overriding standard 2FA requirements.
- Takeover: Entering the code triggered a password reset, locking out the legitimate owner and rerouting all future security notifications to the attacker.
Why the AI Was So Easy to Fool
“Vibe hacking” is when attackers trick AI by acting friendly and casual instead of using complex hacks. The AI was too nice. It was trained to help users, not question them.
Scammers got away with just sending simple requests like, “Link this to my new email,” and the AI followed through without hesitation. The bot failed to ask basic questions such as “Who are you?” or “Prove you own this account.”
The AI wasn’t hacked with code. It was hacked with a conversation. Meta’s chatbot was made to be super helpful rather than doubtful, making it easy to trick. Anyone could do it; all you needed was a casual message.
They let the AI change account details all by itself, with no human checking first. Since the system was built to work fast, it didn’t question commands that sounded official. This shows how risky it is to let AI have direct control over important account stuff.
Who Is Actually at Risk?
Attackers went after high-value accounts with rare usernames, but any user who dealt with the AI for password recovery was at risk too.
The bypass was particularly effective because the email-change command occurred before standard authentication checks were fully verified by a human agent. Consequently, even users with 2FA enabled were vulnerable; the AI-driven recovery workflow essentially bypassed the 2FA layer by validating the request through a new, “verified” email channel.
Meta’s Response and the Unknowns
Meta has shut off the chatbot’s access to sensitive account commands. The bot can no longer automatically change email addresses or reset passwords. Any account changes now require a human to review and approve them first.
Meta also added stronger identity checks. They now do manual reviews to verify each account recovery request before approving it.
But Meta still hasn’t answered some big questions. The company won’t say how many accounts were hacked. They also won’t say how long the vulnerability existed before it was discovered on May 31.
How to Protect Your Instagram Account
Protecting your account is easier than you think. ust follow these easy steps to stay secure:
1. Check your email
- Go to Instagram Settings > Account > Personal Information
- Make sure the email listed is yours. If not, change it immediately.
2. Use an authenticator app for 2FA
- Download Google Authenticator or Authy
- Turn on 2FA in Settings > Security (use app, NOT SMS)
3. Watch for suspicious emails
- If you get an email about account changes, reset your password right away from a trusted device
4. Never share verification codes
- Meta will NEVER ask you to enter a code in chat
- If anyone asks for a code, end the conversation immediately
Hackers are stealing accounts by tricking Meta’s AI into sending them verification codes to reset passwords. It takes just 5 minutes, but this can safeguard your account.
Why This Is Bigger Than One Incident
This isn’t Meta’s first AI security problem. In March 2026, one of their internal AI tools leaked sensitive data, setting off a big alarm. Now with two incidents in three months, people are questioning Meta’s security.
Meta fixed this specific problem, but it shows a bigger issue. Companies are giving AI more control over sensitive account tasks. As AI becomes standard, hackers will target it more.
If an AI can change your password, it basically holds the keys to your digital life. The real question is how much control we should let AI have over our accounts.
Click Here For The Original Source.
