Hackers Hijack Instagram Accounts Through Meta’s AI Flaw

Meta’s AI-powered Instagram support bot was exploited by hackers, allowing them to hijack accounts—including Barack Obama’s White House account, Sephora, and U.S. Space Force officials—simply by asking the bot to change recovery details. Meta has patched the flaw, but the incident highlights serious risks in using AI for sensitive security functions.

Meta launched its AI-powered Instagram Support Bot in December 2025, with a global rollout expanding in March 2026. It was designed to provide 24/7 account help, including password resets, scam reporting, and privacy management, but was later exploited by hackers due to weak safeguards.

The Instagram Support Bot was meant to simplify account recovery, but its exploitation shows how AI-driven customer support can become an attack surface if not properly safeguarded.

What Happened

• Exploit Method: Hackers tricked Meta’s AI support chatbot into linking a target Instagram account to a new attacker-controlled email.
• Password Reset: Once linked, the bot facilitated a password reset, locking out the legitimate owner.
• Bypassing Safeguards: Attackers used VPNs to spoof locations and bypass fraud detection.
• No Alerts: Victims did not receive SMS, push notifications, or warning emails during the takeover.

High-Profile Accounts Compromised

Account	Impact
Obama-era White House Instagram (@obamawhitehouse)	Defaced with politically inflammatory content
Sephora (official account)	Hijacked and disrupted
U.S. Space Force Chief Master Sergeant John Bentivegna	Personal account compromised
Rare “OG” handles (@hey, @jowo)	Valued at over $1M in underground markets

Why It Matters

• AI Security Risks: The bot had backend privileges but lacked identity verification safeguards.
• Prompt Injection Vulnerability: Attackers exploited natural language prompts to override intended security checks.
• Broader Trend: Similar AI manipulation attacks have occurred elsewhere (e.g., dealership chatbots offering cars for $1).

Meta’s Response

• Patch Released: Meta confirmed the vulnerability was fixed on June 1, 2026.
• Account Recovery: Impacted accounts are being secured, though Meta has not disclosed the total number affected.
• Future Safeguards: Renewed scrutiny over reliance on AI for account recovery and password management.

What Users Should Do

• Enable Two-Factor Authentication (2FA): Still critical for other attack vectors.
• Check Recovery Settings: Verify your email and phone number linked to Instagram.
• Monitor for Alerts: Watch for suspicious login attempts or password reset notifications.
• Report Issues: Use Meta’s official support channels immediately if you suspect compromise.

Key Takeaway

This breach shows that AI-driven customer support systems can become attack surfaces if not properly safeguarded. Meta’s incident is a cautionary tale for all platforms deploying AI in sensitive security workflows.

Hackers vs. AI: 86% of Firms Hit by Cyber Threats—Who’s Winning?

Cisco's 2025 Cybersecurity Readiness Index reveals that only 4% of organizations worldwide have reached a "Mature" level of cybersecurity readiness. This is a slight improvement from last year's 3%, but it still highlights significant gaps in global preparedness.

The Index evaluates companies' readiness across five pillars—Identity Intelligence, Network Resilience, Machine Trustworthiness, Cloud Reinforcement, and AI Fortification— and encompassing 31 solutions and capabilities. Based on a double-blind survey of 8,000 private sector security and business leaders in 30 global markets, respondents detailed their deployment stages for each solution. Companies were then categorized into four readiness stages: Beginner, Formative, Progressive, and Mature.

Key Findings:

The lack of cybersecurity readiness globally is alarming as 71% of respondents anticipate business disruptions from cyber incidents within the next 12 to 24 months.

• AI-related security incidents affected 86% of organizations in the past year.
• 49% of respondents believe their employees fully understand AI-related threats, while 48% think their teams grasp how malicious actors use AI for attacks.
• Nearly half of organizations suffered cyberattacks, struggling with complex security frameworks.
• 71% of respondents anticipate business disruptions due to cyber incidents within the next 12 to 24 months.
• Only 45% of organizations allocate more than 10% of their IT budget to cybersecurity, down from 53% last year.

The report evaluates cybersecurity readiness across five pillars: Identity Intelligence, Network Resilience, Machine Trustworthiness, Cloud Reinforcement, and AI Fortification. AI is both a security tool and a threat, with 89% of organizations using AI for threat detection, response, and recovery

The report said that — to tackle today’s cybersecurity challenges, organizations must invest in AI-driven solutions, simplify security infrastructures, and enhance AI threat awareness. Prioritizing AI for threat detection, response, and recovery is essential, as is addressing talent shortages and managing risks from unmanaged devices and shadow AI.