This threat involves attackers manipulating Meta's AI-powered Instagram support bot to reset account passwords by adding a new email address to the account during the recovery process. The attackers used VPNs to simulate login locations matching the victim's usual IP region, then instructed the AI bot to link a new email address, which received a one-time code enabling password reset. The vulnerability allowed unauthorized access to high-value Instagram accounts, which were briefly defaced with pro-Iranian content. Meta confirmed the issue was resolved with an emergency patch and stated no backend database breach occurred. The exploit failed against accounts with MFA enabled, indicating MFA effectively mitigates this attack vector. This case exemplifies new attack surfaces introduced by AI-driven customer support systems.

The impact included unauthorized access and brief defacement of high-profile Instagram accounts, potentially damaging reputations and enabling account takeover. The exploit allowed attackers to bypass normal recovery protections by manipulating an AI support bot. However, no backend data breach occurred. Accounts protected by MFA were not compromised by this attack. The incident underscores the risk of AI chatbots being socially engineered to perform unauthorized actions.

Meta has deployed an emergency patch to address the vulnerability in the AI support assistant bot and secured impacted accounts. Users are strongly advised to enable multi-factor authentication (MFA) on their Instagram accounts, as MFA prevented this exploit from succeeding. No further user action is required to mitigate this specific vulnerability beyond enabling MFA. Monitor official Meta advisories for any additional updates.