Meta has confirmed that its AI support chatbot was exploited to hijack over 20,225 Instagram accounts. The bug allowed hackers to bypass two-factor authentication by requesting a password reset and linking their email address with the victim's account.

The vulnerability stemmed from an unverified email address during the password reset process. Hackers could provide any non-matching email address, and the system would mistakenly send a password reset link to that address instead of rejecting the request, thus granting unauthorized access.

This incident affected high-profile accounts, including Barack Obama's old White House account and Sephora. While Meta claims no personal data was accessed, it remains unclear what information could have been obtained through compromised accounts.

As a result of this exploit, Meta disabled its AI support tool, invalidated password reset links generated by the bug, and enrolled impacted accounts in mandatory security checks to prevent further unauthorized access.