How Hackers Exploited Meta's AI Chatbot to Seize High-Profile Instagram Accounts
Cybersecurity Breach Involving Meta's AI Chatbot
California: Recent reports indicate that hackers have successfully manipulated Meta's AI-driven support chatbot to take control of several notable Instagram accounts, as revealed by cybersecurity experts.
Among the accounts reportedly affected are the former White House Instagram account from the Obama era, boasting over 2.4 million followers, the Chief Master Sergeant of the US Space Force's account, and the Instagram profile of the beauty brand Sephora.
Investigators tracking this incident assert that the attackers exploited Meta's AI support system by persuading the chatbot to initiate password resets for the targeted accounts. Videos circulating in cybersecurity-focused Telegram channels seem to illustrate the methods employed by the hackers.
The researchers noted that the attackers directed the chatbot to send password-reset verification codes to email addresses they controlled. When the chatbot sought identity verification through a selfie video, the hackers allegedly submitted AI-generated videos to bypass the authentication process.
Once the verification was granted, the attackers reportedly changed the original recovery email address to their own, thereby gaining access to the accounts.
Cybersecurity specialists have compared this tactic to social engineering, a traditional method used to deceive individuals into disclosing sensitive information. However, in this instance, the attackers manipulated an AI system instead of a human support agent.
Experts also indicated that this exploit might have bypassed two-factor authentication measures designed to prevent unauthorized access to accounts.
While Meta has not disclosed extensive details about the breach, the company seems to acknowledge the vulnerability. Andy Stone, Meta's communications head, stated on X that the issue has been resolved and that efforts are underway to secure the affected accounts.
"This issue has been resolved, and we are securing impacted accounts," the company mentioned, although the total number of compromised accounts remains unclear.
This incident has raised new concerns regarding the increasing dependence on AI-powered customer support systems across social media platforms. In March, Meta had rolled out AI support tools to all Facebook and Instagram users, enabling chatbots to assist with password resets and other account management tasks.
According to Meta's product page, the AI assistant is intended to help users navigate account-related issues and perform actions like resetting passwords or reporting problematic content without needing to sift through traditional help-center articles.
Meanwhile, some users whose accounts were reportedly compromised have expressed frustration on social media, stating they were unable to connect with a human support representative, highlighting the limitations of AI-only support systems in addressing security concerns.