Hackers exploited Meta's AI support chatbot to take over prominent Instagram accounts, including Barack Obama's White House page, by simply requesting email changes. Meta confirmed the vulnerability and deployed a fix, though researchers report additional exploits may already be in circulation.
Meta's AI-powered customer support chatbot became a vector for account takeovers after hackers discovered they could request email address changes tied to Instagram accounts without proper verification. The vulnerability bypassed two-factor authentication entirely, allowing attackers to gain control of high-profile accounts including those belonging to the Obama White House, Sephora, and the US Space Force Chief Master Sergeant.
Researchers from 404 Media exposed the flaw after documenting the widespread campaign. Meta acknowledged the issue on Monday and stated it had resolved the problem. However, security researchers indicated that exploits targeting the chatbot were already circulating on Telegram, suggesting potential workarounds remain available.
The breach raises significant concerns about relying on AI systems for critical security functions. Meta's chatbot, designed to streamline customer support, lacked sufficient safeguards to verify legitimate account ownership before processing sensitive changes like email modifications.
Meta began alerting affected Instagram users of the compromises. The company's statement confirmed the scope of the incident but provided limited details on how many accounts were targeted or the full duration of the vulnerability's existence.
The incident highlights a broader challenge facing tech companies: balancing automation and convenience against security robustness. As companies increasingly deploy AI chatbots to handle customer service at scale, the risk of security shortcuts becomes more pronounced. Human verification steps, while slower and costlier, often remain necessary for account recovery and modifications.
Security researchers have historically identified multiple methods for account takeovers through support channels, but the use of AI chatbots—which may lack nuanced judgment about suspicious requests—introduces a new dimension to these attacks. The vulnerability underscores the need for mandatory human review on sensitive account changes, regardless of initial requestor authentication.
France's data protection authority (CNIL) has fined Hôpital privé de la Loire €500,000 for failing to adequately protect the personal data of 727,000 patients and their relatives.
The FBI is investigating a possible security breach at an ID verification company that may have exposed driver's license scans belonging to millions of Americans. The agency confirmed the investigation to Bloomberg News on Thursday.
Attackers compromised Coder's Cloudflare infrastructure and injected malicious Terraform modules designed to steal credentials. The unauthorized registry servers delivered the infected packages to users.
A US senator has called on the NSA to provide official guidance on virtual private network selection and usage, citing confusion over the growing array of available options.