Did Meta’s own AI help hack into Instagram users’ accounts? | Explained
In May, multiple Instagram users reported being locked out after hackers reset passwords using verification codes sent to different emails, according to widely shared screen recordings. The recordings suggested Meta’s AI support assistant chatbot helped attackers. Meta spokesperson Andy Stone said the issue was resolved and impacted accounts were being secured, but Meta did not confirm details or affected numbers; TechCrunch reported attacks continued after Meta addressed the issue.
Cybersecurity incident tied to Meta’s AI support tooling raises reputational and regulatory/compliance risk, with potential user trust and engagement impacts.
Article links Instagram account takeovers to Meta’s AI support chatbot being allegedly abused to reset passwords and hijack accounts.
Near-term downside bias from headline risk; magnitude likely limited unless regulators or Meta discloses material scope/controls failures.
Background
Meta rolled out an AI support assistant on Facebook/Instagram in March, distinct from Meta AI, capable of actions like password resets and privacy management.
Why it matters
Allegations that attackers used the AI support assistant to switch to a different email and obtain verification codes could drive user-loss, increased fraud, and potential regulatory scrutiny of AI-assisted account recovery processes.
Market relevance
For META, the market will focus on whether the incident is confirmed, the scale of impacted accounts, and whether regulators require changes to AI-driven support and identity verification.
Market effects
Highlights broader risk for social platforms deploying agentic/AI support flows, potentially increasing scrutiny of identity verification and automated support tooling.
Primarily global consumer internet risk; no specific regional regulatory action cited.
Sets a precedent for AI-enabled customer-support abuse across major platforms, affecting investor risk models for AI features.
Alternative perspectives
If Meta’s spokesperson statements and remediation are accurate, the event may be contained and largely non-recurring, limiting long-term earnings impact.
The article emphasizes high-profile/high-demand accounts; everyday-user impact may be smaller, and the key variable is whether regulators force changes to Meta’s authentication/support workflows.
Key entities
- companyMeta
Subject of the alleged AI-support chatbot abuse tied to Instagram account takeovers.
- personAndy Stone
Meta spokesperson who said the issue was resolved and accounts are being secured, via X replies.
- organizationTenable (Satnam Narang)
Cybersecurity engineer quoted warning about consequential abuse of AI chatbots and persistence by attackers.





