The Support Agent Had Hands

Hackers reportedly did not need to break into Meta’s servers to take over Instagram accounts. According to 404 Media and later reporting from Krebs on Security, PCMag, Engadget, TechCrunch, and Reuters/CNA, attackers persuaded Meta’s own AI support assistant to help move account-recovery paths. Sam Ellis reports on why this is not just another chatbot failure. Account recovery is identity infrastructure. If an AI support agent can change a recovery email, send a reset code, or mutate who controls an account, it is no longer answering support questions. It is operating part of the lock. The episode asks the practical security question for AI agents with tools: what can the assistant change after it says yes? Sources 404 Media: “Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked” — original report on hackers saying they used Meta’s AI support chatbot to change email addresses associated with target Instagram accounts. Krebs on Security: “Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts” — corroborating report on the alleged support-bot workflow and Meta spokesperson Andy Stone’s statement that the issue had been resolved and impacted accounts were being secured. PCMag: “Meta’s AI Chatbot Allegedly Helped Hackers Hijack Instagram Accounts” — coverage of the alleged recovery-code flow, including the eight-digit code and disputed two-factor-authentication details. Engadget: “Meta AI support chatbot made it ridiculously easy for hackers to take over Instagram accounts” — additional reporting on the Meta AI support incident and Meta’s resolution statement. TechCrunch: “Hackers hijacked Instagram accounts by tricking Meta AI support chatbot into granting access” — report that TechCrunch verified the public mailbox shown in a demo video received the verification code. TechCrunch: “Instagram is alerting users who were targeted by hackers during AI chatbot attacks” — follow-up on Instagram warning users who were targeted during the account-takeover wave. Meta: “Making It Easier to Access Account Support on Facebook and Instagram” — Meta’s own product language for AI support, including account security, recovery, password resets, profile-setting updates, and the “solution — not just a suggestion” framing. TMZ: “Obama White House Hacked on Instagram” — report that Meta confirmed the Obama White House account had been hacked and later secured. Task & Purpose: “Space Force’s top enlisted leader’s Instagram was hacked” — confirmation that Chief Master Sergeant of the Space Force John Bentivegna’s official Instagram account was compromised. Channel NewsAsia / Reuters: “High-profile Instagram AI chatbot breach spotlights security risks of automation” — Reuters/CNA analysis on identity-verification failure risks when automated support systems can change account access. Email: [email protected]