Hackers used Meta’s AI support system to hijack over 20,000 Instagram accounts

Meta disclosed that a flaw in Instagram’s AI-powered High Touch Support account recovery allowed attackers to receive password reset links for accounts they did not own, leading to 20,225 account hijackings; attackers reportedly used VPNs and simple social-engineering interactions with the AI assistant and targeted high-value and high-profile accounts. Meta disabled the affected workflow, invalidated reset links, required additional authentication for potentially impacted users, and will fix the email verification logic while reviewing similar recovery flows across its platforms.