What happened
Instagram uses an AI help assistant to deal with account problems. Hackers found they could ask it to change the email address on someone else’s account. It did, without properly checking who was asking.
With their own email on the account, the hackers reset the password and took it over. They didn’t need to trick the owner or get into their inbox.
Meta told regulators 20,225 people were affected. The problem began on 17 April 2026 and was found on 31 May. Hackers had reportedly been talking about it since March. Accounts taken included those of Sephora, the top enlisted leader of the US Space Force, and an old Obama White House account.
Why it went wrong
The bot was too eager to help. It didn’t do strong identity checks. In some cases, two-step login was skipped. Location checks were fooled by setting a VPN near the owner, and selfie checks were fooled with computer-made faces.
Impact
- Over 20,000 accounts taken over, including famous ones.
- Some people couldn’t get their accounts back, because the AI bot was the only help on offer and there was no human to talk to.
- Meta fixed it that weekend and said it was “securing impacted accounts.”
The lesson
- A helpful bot needs firm rules. Changing who owns an account should never happen on request alone.
- There should always be a human to talk to. Especially when the bot is the problem.
- Turn on two-step login, and check your account email from time to time.