Instagram is alerting users who have been targeted by hackers during chatbot AI attacks

The large-scale hacking campaign that relied on simply asking Meta AI’s chatbot to take over a victim’s Instagram account appears to have continued even after the company said the issue had been resolved. At the same time, the company is striving to secure targeted accounts and alert victims.

Over the weekend, hackers claimed to be exploiting Meta’s AI support chatbot to take over several high-profile Instagram accounts. At the same time, a large number of people have complained on social media that their Instagram accounts have been hacked, some using short and unique user accounts.

TechCrunch has seen examples of allegedly hacked handles containing common first names or country names, which can then be resold almost as collectibles on a gray market for so-called “OG handles.” Other victims of the hacking spree appear to be Obama’s dormant White House account (which Meta questioned), and the account of US Space Force Staff Sergeant John Bentevna.

These attacks were so simple that calling them a hack might give the people behind them too much credit, while at the same time not putting enough blame on Meta for not preventing the primitive attacks from hijacking people’s accounts.

The hackers simply told Meta’s chatbot that they were the target’s account holder, and asked the bot to link that person’s account to an email they controlled. The chatbot complied with the request, allowing the hacker to reset the target account’s password and take control of the account, and in some cases resulted in victims being locked out. Meta employees or contractors did not participate in the chat at any time.

On Monday, Meta spokesman Andy Stone said that “the issue that occurred has already been fixed.”

But on Tuesday, more Instagram users claimed their accounts had been hacked.

At the same time, TechCrunch saw discussions between members of the Telegram channel where the hacking technique was advertised, who claimed to still be able to exploit Meta’s chatbot, and were advertising hacked handles for sale, at the time of TechCrunch’s writing. (It’s important to note that it’s difficult to know if all of these accounts were hacked due to the same technique.)

In a subsequent post on X, Stone said: “Some people may receive password reset notifications and others may be asked security questions when they try to log in to their accounts.”

Stone told TechCrunch in an email that Meta secured the affected accounts on Monday, then began sending password reset emails. When asked by TechCrunch, Stone did not say how many users were hacked.

Several people reported that Meta began notifying users that they were being targeted.
Victims have publicly reported receiving emails from Instagram warning them that the company “has detected some suspicious activity that indicates your Instagram account may have been hacked.” The message also stated that the company had taken measures to secure the account, and asked the user to reset their password.

As 404 Media noted, Meta announced in March that it was applying artificial intelligence to automate its support for users, saying that the AI-powered chatbot is “designed to solve account issues from start to finish,” and will have the ability to “securely reset your password.” This suggests that a chatbot can perform actions that might previously have required a human in the loop, given how important they are.

For years, there has been a thriving market where hackers stole and then sold “OG” usernames, a reference to the usernames and handles used by early users of Instagram. However, in the past, taking control of these accounts required more sophisticated strategies, such as phishing the victim, taking over their phone numbers, or bribing insiders at telecom companies.

Here, the hackers just asked, and Meta’s chatbot responded.