Meta has confirmed that hackers hijacked at least 20,225 Instagram accounts by abusing a security flaw in its AI-assisted recovery chatbot. The campaign, which ran from April 17 until early June 2026, allowed attackers to redirect password reset links to unauthorized email addresses. Users whose accounts lacked two-factor authentication were completely compromised as a result.
How the AI Chatbot Flaw Worked
According to a data breach notification filed with the Maine attorney general's office, as reported by this week in security, 404 Media, and TechCrunch, the vulnerability existed in Meta's AI-assisted account recovery tool for Instagram. The chatbot itself functioned as designed, but a flaw in a separate code path failed to verify whether a requested password reset email matched the address on record.
When an attacker supplied a brand-new email address and requested a password reset, the chatbot complied without checking ownership. The system then issued a verification link directly to the hacker, allowing unauthorized third parties to gain full control of the account.
Extent of the Account Hijackings
Meta notified at least 20,225 people that their accounts had been compromised during the multi-month exploit window. The takeover granted attackers access to direct messages, profile details, dates of birth, contact information, and linked accounts.
Key details from the breach notification include:
- Campaign Duration: Active from April 17, 2026, until its remediation in early June 2026.
- Target Constraint: Only accounts without two-factor authentication (2FA) turned on were vulnerable to total takeover.
- Response Actions: Meta disabled the AI chatbot, removed the faulty code path, and prompted affected users to re-authenticate.
- Platform Audit: Meta initiated security reviews across its other conversational AI interfaces to prevent similar exploits.
Remediation and Outstanding Questions
Meta stated that it has secured the chatbot pipeline and instructed all impacted users to reset their credentials through official, verified channels. However, a major caveat remains: Meta noted in its formal filing that it is "unaware" of what specific personal data or private messages were viewed or exfiltrated while the hackers held access.
Why it matters
Integrating AI chatbots into sensitive support workflows like account recovery can create severe security loopholes if traditional authentication checks are bypassed. Organizations leveraging AI for customer identity management must ensure backend authorization logic remains strictly enforced regardless of the conversational interface.