Hackers Exploit Meta AI Support Bot to Hijack High-Value Instagram Accounts

Key Points

• Hackers manipulated Meta's AI support chatbot to reset passwords on high‑value Instagram accounts.
• Compromised handles @hey and @jowo were valued at over $1 million on the gray market.
• The attack exploited a "confused deputy" flaw, using crafted prompts to trick the AI.
• Accounts with any form of multifactor authentication, including SMS codes, resisted the takeover.
• Meta launched the AI assistant in March 2026, promising 24/7 support for user issues.
• Security experts recommend out‑of‑band verification, rate limiting, action logging, and deterministic gates to safeguard AI‑driven operations.
• The breach highlights the risk of granting AI agents elevated privileges without robust safeguards.