ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About Attackers talk Meta's AI support assistant into resetting Instagram accounts

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Meta· Meta AI support assistant (High Touch Support)

Attackers talk Meta's AI support assistant into resetting Instagram accounts

Attackers chatted with Instagram's AI support assistant, got it to link their email to other people's accounts and send a one-time code, then reset passwords; Meta puts the total at up to 20,225 accounts.

Reported from about 31 May 2026: attackers used a VPN near the target's home area, opened the AI support chat and asked it to link a new email address to the victim's account. Krebs and Malwarebytes say the assistant added the address and sent the code that allowed a password reset. Meta's breach notice to the Maine Attorney General gives 17 April 2026 as the start, 31 May as discovery and 20,225 as an upper bound. It blames a bug in a separate code path that did not check the email matched the account, and says the tool otherwise worked as intended. Accounts with two-factor authentication held. Whether the assistant itself made the change through a tool, or a backend flow did, is not settled by any source we could open.

First incident action to disclosure
45 days
First incident action to discovery
44 days
Noticed first by
Someone else
Caught
The damage

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 17 Apr 2026

    First incident action

    Start of unauthorised access, per Meta's breach notice

    Date as relayed by press. BleepingComputer says it is likely the first attack but Meta did not state when attacks began.

    Reported

  2. 31 May 2026

    Hijacked and defaced accounts surface; the method spreads on Telegram

    Reported victims include the former Obama White House handle, a US Space Force chief master sergeant's account and Sephora. The reported method: ask the support assistant to link a new email, receive a code, reset the password.

    Reported

  3. 31 May 2026

    Handler found out · 44 days in

    Meta identifies the vulnerability

    Date given in Meta's notice. It does not say what signal Meta saw.

    Reported

  4. 1 Jun 2026

    Disclosed · 45 days after the first incident action

    Meta says the issue is resolved

    Andy Stone replied on X that the issue was resolved and Meta was securing impacted accounts. Meta gave no explanation to TechCrunch or Engadget at the time.

    Reported

  5. 2 Jun 2026

    BleepingComputer: users locked out, deepfake selfie method alleged

    Owners said they could not reach a human. The reported method adds an animated selfie to pass the assistant's check; BleepingComputer could not verify it.

    Reported

  6. 8 Jun 2026

    Meta's breach notice to the Maine Attorney General reported: 20,225 people

    Meta calls the figure an upper bound. It says HTS was disabled, reset links invalidated, affected accounts put through a security checkpoint, and the email check will be fixed before relaunch. Filing date not confirmed; 8 June is the date of press coverage.

    Reported

  7. 10 Jun 2026

    Engadget corrects: 2FA accounts got reset requests but were not taken over

    Reported

Agent failures

Hijacked by an attacker, Unauthorised accessShow
Map to frameworks

  • Hijacked by an attacker

    Attackers used chat requests, reportedly with a VPN near the victim's home area, to get the support assistant to act for them. Meta attributes the outcome to a missing email check rather than to the assistant.

  • Unauthorised access

    Up to 20,225 Instagram accounts were reset and logged into by people who did not own them.

How it was found

Found first by someone else, from the damageShow
Found first by
Someone else
How
The damage
Found to disclosed
1 day

Account owners and researchers noticed first: defaced and hijacked accounts, including the former Obama White House handle and researcher Jane Manchun Wong's account, and a method circulating on Telegram. Meta's notice puts its own discovery at 31 May, about six weeks after the start date it reports. It does not say what signal Meta saw.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
UnknownDescribed only as Meta's AI support assistant; no model or vendor is named.
UnknownNo source says.
PartialReported checks: location signals that a VPN defeated, a selfie check allegedly beaten with an animated photo, and 2FA, which held. Meta's notice says the email check was missing.
UnknownNot published or described.
WeakOne attacker request is shown in a video as reported by 404 Media: link a new email to a named username. No Meta-side record of the conversations is public.
WeakPress says the bot could add an email, send a code and show a reset button; Meta's notice calls it the HTS tool and does not describe the assistant's tools.
UnknownNothing about the assistant's own network setup. Attackers' VPN use is reported.
WeakOnly attacker videos and screenshots from Telegram, relayed by press. Meta has published no transcripts.
WeakMeta gives a discovery date, 31 May, and no signal.
PartialUp to 20,225 accounts, 30 in Maine. Meta does not know what data was accessed and says some counted accounts may have been opened by their owners.
WeakMeta says a bug in a separate code path skipped the email-match check. Press says attackers tricked the bot. The sources do not settle which part the assistant played.
PartialHTS disabled, reset links invalidated, checkpoint and password reset for affected accounts, fix planned before relaunch, similar flows under review. Not verified.

Controls that apply

  • Identify

    Test adversarially before release

    The method needed no technical skill: ask the assistant to link a new email to a target username, then reset the password. A social-engineering test before launch would have surfaced it before it circulated on Telegram. Meta says the tool otherwise worked as intended.

  • Protect

    Treat what the agent reads as untrusted

    Attackers asked the support chat to link a new email address to someone else's account, and Krebs and Malwarebytes say the assistant added the address and sent the code that allowed a reset. Treating a stranger's chat request as data would have kept it from triggering an account change on its own. Whether the assistant or a backend flow made the change is not settled.

  • Check each action against policy before it runs

    Meta blames a bug in a separate code path that did not check the new email matched the account. A deterministic check outside the model, run before any email change, would have refused a link to an address with no tie to the account holder.

  • Give each agent the least agency its task needs

    Press reports say the support assistant was connected to account management systems and could change an account's email. A support chat limited to answering and handing over to a verified recovery flow would have had no email change to make.

  • Ask a person before high-impact or irreversible actions

    Linking a new email that leads to a password reset is an account change. Held for a person's approval, each request would have reached staff before the one-time code went out, rather than running unchecked across up to 20,225 accounts.

  • Detect

    Record every agent action, outside the agent

    A record of each email change and reset code the support assistant set off, with the session it came from, would show the run of changes from about 17 April and settle what the sources leave open: whether the assistant itself made the change.

  • Monitor every run and alert on what does not fit the task

    Meta's notice puts its discovery at 31 May, about six weeks after the 17 April start it reports, and account owners and researchers noticed first. Monitoring would have flagged a run of email-link changes and reset codes for accounts from sessions that were not the owners', on a VPN.

  • All controls →

Coverage and commentary

1 statement, 10 articlesShow

What the parties involved said

  • Meta (breach notice, via SecurityWeek)

    Says the tool itself worked as intended and a bug in a separate code path let a reset link go to an unassociated email. Says 2FA accounts were not taken over and the true number could be smaller.

Press coverage

All 10 sources

  1. Press

    Over 20,000 Instagram accounts stolen in Meta AI support hack ↗BleepingComputer · 2026-06-08

  2. Press

    Hackers used Meta's AI support system to hijack over 20,000 Instagram accounts ↗Help Net Security · 2026-06-08

  3. Press

    Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse ↗SecurityWeek · 2026-06-08

  4. Press

    Meta's AI support chatbot made it ridiculously easy for hackers to take over Instagram accounts ↗Engadget · 2026-06-01

  5. Press

    Hackers Used Meta's AI Support Bot to Seize Instagram Accounts ↗Krebs on Security · 2026-06-01

  6. Press

    Hackers hijacked Instagram accounts by tricking Meta's AI support chatbot into granting access ↗TechCrunch · 2026-06-01

  7. Press

    Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked. ↗404 Media · 2026-06-01

  8. Press

    Instagram users locked out after Meta AI abused to steal accounts ↗BleepingComputer · 2026-06-02

  9. Commentary

    Meta's AI support bot happily handed Instagram accounts to hackers ↗Malwarebytes · 2026-06-04

  10. Commentary

    Instagram AI chatbot breach may have affected over 20,000 accounts, Meta discloses ↗The Decoder · 2026-06-08

Entry id meta-instagram-ai-support-takeover-2026 · overall Reported · impact major