Instagram Recovery Tool Bug Exposed 20,225 Accounts to Password Reset Abuse

Meta disclosed that a validation bug in Instagram’s AI-assisted "High Touch Support" account recovery flow allowed attackers to request password reset links sent to attacker-controlled email addresses, potentially enabling takeover of accounts without two-factor authentication; 20,225 users may have been affected (30 in Maine). Meta disabled the tool, invalidated reset links, placed affected accounts behind mandatory security checkpoints, will notify impacted users, and is reviewing and fixing recovery flows across its platforms.