Meta AI Bug Exposes Over 20,000 Instagram Accounts

Meta disclosed that a bug in its AI-driven High Touch Support account recovery tool caused password reset links to be sent to email addresses not associated with targeted Instagram accounts, enabling attackers to take over 20,225 accounts (if victims lacked 2FA) and exposing contact details, DOB, posts, direct messages, activity history, profile information, and linked services; Meta disabled the tool, invalidated reset links, enrolled affected accounts in a mandatory security checkpoint, and will fix the authentication check and review recovery flows.