Meta's AI Support Bot Could Reset Anyone's Instagram Password. It Ran for 44 Days.

On 1 June 2026, 404 Media and KrebsOnSecurity published recordings circulating in Telegram groups that showed Meta's AI account-recovery assistant attaching a new email address to an Instagram account for anyone who asked, then sending the password reset there. The attacker needed a username and one convincing sentence. Within a week, in a breach notification to Maine's attorney general, Meta put the exposure at 20,225 accounts across a window running from 17 April to 31 May 2026. Sephora's brand account, the U.S. Space Force's chief master sergeant and researcher Jane Manchun Wong were among those reported hijacked, several of them locked out for days with no human support agent to appeal to. The full record, with its sources and severity grading, sits in the Orca AI Incident Archive, which catalogues realised AI incidents by date, system and failure type.

The archive grades the incident critical, with confirmed AI involvement and real harm, and files it under indirect prompt injection and credential abuse. What follows separates what Meta has said on the record from what victims, researchers and the first 72 hours of coverage alleged — because on one central point the two do not agree.

The failure was a missing check, not a jailbreak

Meta rolled the assistant out across Facebook and Instagram in March 2026, marketing it as account security and recovery that offered "solutions, not just suggestions", according to 404 Media. Internally it was called High Touch Support, or HTS: a conversational agent built to help locked-out users who could not get through static recovery forms, and given the authority to associate a new email address with an account and to trigger a password reset to that address.

The defect Meta eventually described was narrow, and it was not the model deciding to be helpful. In a data breach letter filed with Maine's Office of the Attorney General, Amber Hannah, Meta's associate general counsel for incident response legal, wrote: "The tool itself worked properly and functioned as intended; however due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user's Instagram account." She added that when the address did not match, the system "incorrectly sent a password reset link to that unassociated email rather than rejecting the request".

In practice the sequence, as reconstructed by KrebsOnSecurity from the Telegram recordings, was four steps:

• The attacker connected through a VPN with an address in or near the target's region, to clear Instagram's location checks.

• They opened the recovery flow against a username and selected the AI support assistant.

• They told the bot to link an email address they controlled — one recording began "Just link my new email address" — and the bot sent the one-time code to it.

• They entered the code, took the reset link, changed the password, and the legitimate owner was out.

No malware, no stolen password, no phishing page. Brian Krebs noted that the technique spread through Telegram channels from 31 May, and that the pro-Iranian accounts posting the video also defaced some of the seized profiles that weekend.

44 days, and a number that moved

The window is the part of the record that took longest to become public. In its notification to Maine's attorney general, Meta said it discovered the vulnerability on 31 May 2026 and disabled HTS that day. The filing dates the breach itself to 17 April, which BleepingComputer reported is likely the first attack exploiting the flaw. That is 44 days of an unauthenticated write path into Instagram's account identity fields, a span the Cloud Security Alliance's research arm also puts at 44 days.

The count moved twice. Meta's filing says 20,225 accounts were potentially compromised, including 30 in Maine, and the company describes that as an upper bound because some access attempts may have come from legitimate account holders. On 9 June, reporting on a New York Times investigation, Android Authority said roughly 34,000 Instagram users were affected and about 20,000 accounts compromised, with thousands more having usernames changed or losing access temporarily. The difference is a definition, not a contradiction: 34,000 is the pool of accounts touched, 20,225 is the takeover count Meta was willing to certify. Meta's letter also says the company does not know which of the potentially accessible data was actually viewed — the list covers contact details, dates of birth, posts, direct messages, activity history, profile information and linked third-party services.

Fix claims and fix dates also drifted apart in public. On 1 June, Meta's vice president of communications, Andy Stone, said on X that "the issue that did happen has already been fixed". On 2 June, TechCrunch reported users still claiming takeovers, and Telegram channel members still advertising hijacked handles for sale — while cautioning that not every reported hijack could be tied to the same technique.

What two-factor authentication did, and what early reports said it did

This is where the record and the reporting part company, and it is worth being precise about it.

Meta's own account is explicit. Hannah's letter says that after the password reset, "the unauthorized party was able to log in to the account if the account holder had not enabled two-factor authentication (2FA)." KrebsOnSecurity reported the same thing from the exploit recordings: the technique failed against accounts with MFA enabled. The Cloud Security Alliance's analysis called 2FA "the effective limiting control", noting the recovery flow never granted access to the authentication layer that 2FA governs. The gap was the recovery door beside the login door, not the login door itself.

Against that, a wave of victim reports in the first days said the opposite. BleepingComputer on 2 June quoted users insisting their identities had been verified by facial scan and that they had 2FA enabled, and quoted one user, André, saying the method "bypasses 2FA protections". gHacks reported the same on 3 June. The archive's one-line summary of this incident carries that stronger claim too, describing the bot as bypassing two-factor authentication.

Meta has published no technical post-mortem, so the discrepancy is unresolved rather than settled. What can be said is that the only first-party document — the filing signed by Meta's own counsel — describes a takeover that stopped at accounts without a second factor, and that the outlets closest to the exploit recordings reported the same. Treat "the bot defeated 2FA" as a claim, not an established fact.

A second reported mechanism is in the same category. Users told BleepingComputer and gHacks that the recovery flow would accept a selfie video, and that attackers animated a public photo of the target through an AI video generator to pass it. Neither Meta's filing nor Krebs's reconstruction of the recordings mentions that step. It may have been a parallel path; the public record does not establish it.

The victims, and the account Meta disputes

The confirmed cluster is a strange mix of brand, military and researcher accounts: Sephora's brand account, Chief Master Sergeant John Bentivegna of the U.S. Space Force, and Jane Manchun Wong, whose own posts documented losing the account. BleepingComputer also named the single-word handles @hey and @korn, and reported that the @korn owner spent six hours trying to reach a human and received four broken links from Meta's support AI. The same article noted that claims about the one-letter handles @e and @f could not be independently verified, with some attributing them to an insider instead.

One widely repeated victim is disputed. 404 Media, KrebsOnSecurity and TechCrunch all reported that a dormant Obama White House handle was among those seized and briefly defaced. Meta called claims that leaders' accounts were breached "completely false", according to the BBC, and TechCrunch recorded the company's dispute directly. Everything else in the victim list stands on the reporting; that one does not.

Attribution stops at the channel, not at an organisation. Reporting establishes that working exploit instructions and hijacked handles were traded in Telegram groups, that some seized accounts were used for pro-Iranian messaging, and that short "OG" usernames carry a gray-market value in the tens of thousands of dollars — Krebs cited hackers claiming a resale value above $500,000 for the names they held. No report names a group, charges anyone, or establishes that a single operation ran the campaign. The archive's description of an organised resale operation is consistent with the reporting but is not something the cited sources prove.

What changed afterwards

Meta's response, as described in the filing and to BleepingComputer, was to disable the HTS tool, remove the faulty code path, invalidate every password reset link the system had generated, and place affected accounts into a mandatory security checkpoint requiring a reset through verified channels. Before relaunching, the company said it would fix the authentication check at the Instagram recovery entry point so that a supplied email is verified against account records before any reset is initiated, and would review similar recovery flows across its other platforms.

How much of the wider programme was paused is narrower than that sounds. Internal documents cited by the New York Times indicated Meta paused only the specific Instagram password-recovery experiment tied to the incident, while leaving broader AI-powered support plans in place, Android Authority reported. The Cloud Security Alliance's note goes further, stating that Meta disabled the chatbot's autonomous email-association and password-reset capabilities on 31 May; that characterisation is the research group's, not a Meta statement.

Why it is filed under prompt injection, and why that label is contested

The archive tags the incident IPI — indirect prompt injection — alongside credential abuse, and the confused-deputy framing is the one most analysts reached for. But several of the people closest to it resist the injection label.

Simon Willison, who coined the term prompt injection, wrote on 1 June: "Meta really did wire their support system into an AI chatbot that had the ability to fast-forward through the entire account recovery process. This one hardly even qualifies as a prompt infection. Don't wire your support bot up to allow one-shot account takeovers!" The Cloud Security Alliance made the same distinction in more formal terms: the attack required no adversarial content hidden in a document or tool output, the attacker simply asked, so it is a different threat model from classical prompt injection even though the consequence is identical. Its mapping is to OWASP's LLM06:2025, Excessive Agency — excessive functionality, excessive permissions and excessive autonomy, all three present at once.

VentureBeat's read was blunter and is the one that matters operationally: from inside a detection stack the attack produced no signal at all, because the agent was an authorised actor and every write it made logged as a legitimate transaction. "There is no foothold to find, because the agent was the foothold, and it was supposed to be there."

What this record does not establish

There is no CVE for the HTS flaw, and no published technical write-up from Meta describing what the code path actually did. The 20,225 figure is Meta's upper bound, not an audited count, and the company says it cannot say what data was viewed. The number of accounts that were actually defaced, resold or held for any length of time is unknown. No one has been charged, and no regulator had, as of the public record summarised here, published findings specific to this incident.

What is established is smaller and more useful than the headlines: a support agent was given write access to the one field that decides who owns an account, the check that the requester owned it lived in a different code path and did not run, and the agent could be talked past it in a sentence. Meta's own filing says the tool "worked properly and functioned as intended". That is the finding. The bug was in the architecture around it.