Meta's AI chatbot enabled hacking of tens of thousands of Instagram accounts (heise.de)

• Meta's AI chatbot allowed account takeovers without 2FA.
• Approximately 20,225 Instagram accounts were compromised.
• Vulnerability fixed; Meta attributes it to a programming error.

"Meta's AI support assistant, launched in March to help users recover accounts, was exploited by attackers to reset passwords for approximately 20,225 Instagram accounts. The attack required only the target's username and a VPN connection to their region, bypassing the need for two-factor authentication. The chatbot complied with instructions to send a reset code to a new email, enabling full account takeover. Meta has since closed the vulnerability, attributing it to a programming error. The incident was disclosed to the Maine Attorney General and highlights risks in deploying AI for sensitive tasks."