Hackers exploit Meta AI support chatbot to hijack high-value Instagram accounts

Hackers manipulated Meta's automated AI customer support chatbot in early June to hijack highly valuable, short-character Instagram accounts, bypassing standard security protocols to steal handles worth an estimated $1 million before the exploit was patched.

The attackers targeted rare "og" handles like @hey and @jowo by exploiting the chatbot's administrative capabilities. The exploit represents a classic "confused deputy" vulnerability, where an AI agent with elevated system permissions is tricked by external prompts into executing unauthorized administrative actions on behalf of unprivileged users.

Mechanics of the exploit

The vulnerability stems from the chatbot's integration with Meta's internal account management systems. Unlike traditional, deterministic support portals that rely on strict, hard-coded rules, the new system utilized a large language model. This design allowed attackers to bypass traditional code-level security checks entirely.

By feeding the chatbot carefully structured text prompts, the hackers convinced the AI that they were the legitimate owners of the targeted accounts. Because the model possessed the authority to modify account details, it updated the associated email addresses and phone numbers without requiring manual human review.

The confused deputy problem

As per some reports, security analysts point to the fundamental challenge of securing natural language interfaces. Traditional software relies on strict boundaries, but LLMs process instructions and data within the same context window.

This lack of separation makes it difficult to prevent the model from treating user input as system commands. Security researcher Andrew Godwin analyzed the structural risks of such integrations on AeraCode, arguing that LLMs must be constrained with the same strict limitations applied to untrusted human users.

Godwin noted that giving an LLM direct access to write APIs without secondary verification channels inevitably leads to privilege escalation. When a system treats natural language as executable logic, any user who can talk to the model can potentially control its underlying capabilities.

High-value targets and resale

The stolen accounts were quickly listed for sale on gray-market forums. Short, dictionary-word Instagram handles carry significant prestige and financial value in online communities. Hackers often target these accounts for clout, brand impersonation, or direct resale to high-bidding buyers.

Security monitors ZachXBT and Dark Web Informer confirmed that multiple high-profile accounts changed hands during the active exploitation window. Even brief control of these handles allows attackers to run phishing campaigns or damage the reputation of the original owners.

Mitigation and multifactor authentication

Despite the sophistication of the chatbot manipulation, basic security measures proved highly effective at stopping the attacks. Reports from KrebsOnSecurity indicated that the exploit failed against any Instagram accounts that had active multifactor authentication (MFA) enabled.

Even the least robust form of MFA, such as one-time codes sent via SMS, was sufficient to block the automated takeover attempts. The chatbot was apparently unable to bypass the secondary verification step required to finalize the account changes.

Meta has since patched the specific vulnerability, restricting the chatbot's ability to modify sensitive account settings without out-of-band verification. However, the incident highlights the ongoing industry rush to deploy autonomous AI agents with broad administrative permissions.