Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

Meta confirmed that over 20,000 Instagram accounts were compromised through a vulnerability in its AI-assisted account recovery chatbot, which hackers exploited to reset passwords and take control of accounts without two-factor authentication. The breach lasted from mid-April until this week, allowing attackers to access personal information, direct messages, and account activity after tricking the chatbot into sending password reset links to attacker-controlled email addresses. Meta has disabled the chatbot and removed the vulnerable code path while notifying affected users to reset their passwords.