Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse
Source SecurityWeek
Rated by Threat Radar
Data as of 8 Jun 2026, 06:48 UTC
What to do
AI-suggested
Meta has disabled the vulnerable High Touch Support tool and will only re-enable it after fixing the underlying bug. Password reset links generated by the exploit have been invalidated. Affected accounts have been reset and enrolled in mandatory security checkpoints. Meta plans to notify impacted users and recommend reviewing security settings and enabling two-factor authentication. Users should enable 2FA to protect their accounts from unauthorized access. No further action is required until Meta re-enables the tool with a fix.
Description
Meta disclosed that approximately 20,000 Instagram accounts were compromised due to abuse of an AI-powered account recovery support tool called High Touch Support (HTS). The vulnerability allowed attackers to request password reset links sent to email addresses not associated with the targeted accounts, enabling unauthorized access if two-factor authentication was not enabled. The flaw was caused by a bug in a code path that failed to verify the email address ownership properly. Meta disabled the tool, invalidated the reset links generated by the exploit, reset passwords of affected accounts, and enrolled them in mandatory security checkpoints. Notifications and 2FA recommendations will be sent to impacted users. It remains unclear if personal data was accessed, but attackers could have viewed profile and interaction information. The incident was reported to authorities and discovered on May 31, 2026.