tech
Hackers hijacked Instagram accounts by asking Meta's own AI chatbot to reset the password
Hackers tricked Meta’s AI support chatbot into adding their email to victims’ Instagram accounts and resetting passwords. No victim email access needed.
TL;DR
- Hackers compromised Instagram accounts by tricking Meta's AI support chatbot.
- The attack did not require access to the victim's email, phishing, or malware.
- Attackers used a VPN to spoof location and then prompted the chatbot to add a new email and reset the password.
- The AI chatbot sent a verification code to the hacker's email, which was then used to complete the takeover.
- Comprised accounts included the Obama-era White House Instagram handle and US Space Force Chief Master Sergeant John Bentivegna's account.
- The vulnerability stemmed from the AI chatbot not verifying the identity of the user asking for account changes.
- This incident is a case study in the dangers of AI chatbots with account management permissions.
- This is the third significant AI deployment failure reported in a single week, following issues with Starbucks and Waymo systems.