This incident involves an abuse of Meta's AI-powered customer support assistant for Instagram account recovery. Attackers used social engineering techniques to convince the AI bot to add a new email address to targeted accounts as part of the password reset process. Once the new email was linked, the bot sent a one-time code to that email, allowing attackers to reset the password and take control of the account. The exploit was demonstrated via a video circulated on Telegram by pro-Iran hackers. Meta confirmed the issue was resolved with an emergency patch and stated no backend database was breached. The vulnerability highlights the new attack surface introduced by AI chatbots handling sensitive account recovery workflows.

The vulnerability allowed unauthorized attackers to hijack Instagram accounts by manipulating the AI support bot to reset passwords without proper verification. High-value accounts with short usernames were targeted and briefly defaced with pro-Iranian content. The exploit failed against accounts protected by any form of MFA, indicating that accounts without MFA were at risk. Meta confirmed that no backend data breach occurred, limiting the impact to account hijacking via the AI bot's password reset functionality.

Meta has deployed an emergency patch to address the vulnerability in the AI support assistant bot and secured impacted accounts. Users are strongly advised to enable multi-factor authentication (MFA) on their Instagram accounts, as the exploit did not succeed against accounts with MFA enabled. No further user action is required to mitigate the vulnerability beyond enabling MFA. Monitor official Meta communications for any additional updates.