The story so far: In May, a number of Instagram users were locked out of their accounts by hackers. Many of the affected users took to other social media platforms like Reddit and X (formerly Twitter) to post their complaints. Screen recordings later circulated online suggested that their Instagram accounts were hacked with the help of Meta’s own AI support chatbot. Adding to the users’ worries was the lack of transparency from Meta’s side about the security lapse, fuelling fears of an AI-enabled hack.
How were users’ Instagram accounts hacked?
Meta rolled out its AI support assistant chatbot on Facebook and Instagram in March. The feature is different from the company’s better known Meta AI. The AI support assistant can take action for users when it comes to requests such as reporting content, understanding content takedowns, managing privacy settings, resetting passwords, and updating profile settings.
Several widely-circulated recordings and images of the hack revealed hackers purportedly instructing the Meta AI support assistant to use an email ID that was different from the one associated with users’ Instagram accounts. After the switch was made, hackers were able to access the verification code sent to the new email ID. They used this to reset the account password and hijack the user’s Instagram account.
Many affected users claimed they were logged out of their accounts and that trying to contact Meta for help led them to another AI chatbot. Some noted they had been unfairly penalised after being hacked.
Multiple high-profile accounts were also hacked around this time period, such as the White House Instagram account of former U.S. President Barack Obama (@obamawhitehouse), which last posted in 2017. At the time of writing this story, Meta did not confirm whether this specific security breach is linked to hackers who used the Meta AI support chatbot.
According to TechCrunch, the attacks on users’ accounts continued even after Meta addressed the issue.
What was Meta’s response?
While the company did not issue a formal statement about the hack, Meta spokesperson Andy Stone replied to users on the X platform about the cyber-attack. “This issue has been resolved and we are securing impacted accounts,” Mr. Stone told one user, without offering further confirmation or denial.
Mr. Stone told another X user that Instagram was trying to restore access to affected individuals, which meant that some users could see password reset notifications or security question verification while logging in. This, in turn, triggered alarm and suspicion amongst some users who worried they were being targeted by additional phishing attacks.
The Hindu reached out to Meta multiple times in order to clarify the details of the exploit and learn how many users were affected, but did not receive an official response.
Are such AI-enabled attacks common?
While malicious actors have adopted Generative AI and agentic AI technologies to launch phishing attacks or social engineering attacks at scale, Meta’s case is unique. Here, the shared evidence points to the company’s own AI customer support chatbot helping hackers commit cyber crimes. Unlike other cyber-attacks that use third-party AI tools, this incident breaks the trust that a customer places in a company’s supposedly vetted AI chatbot.
Satnam Narang, Senior Staff Research Engineer at the cybersecurity company Tenable, said that the Meta incident was “one of the most consequential abuses of AI chatbots” seen thus far. He warned that as companies begin using AI to power their chatbots, more such incidents can be expected.
“The incident with Meta was believed to have been addressed, but persistent attackers still found ways to continue to leverage the chatbots for nefarious purposes. It is believed that this incident is now resolved, but once Pandora’s box is opened, we can expect attackers to start hunting for and probing other chatbots for potential exploitation,” said Mr. Narang.
He added that most everyday internet users did not have to worry about their accounts, observing that many hacked targets were those with high-demand Instagram usernames, or accounts belonging to high-profile users.
“The downstream effects are more likely to affect users if an account is hijacked, and it is used to conduct follow-on attacks, whether it’s phishing or financial-fraud related, that is where most everyday internet users may be impacted,” explained Mr. Narang.
As experts have stressed in the past, multiple layers of security — two-factor authentication (2FA) and multi-factor authentication (MFA) — help to safeguard accounts. This is especially crucial for celebrities, business users, official bodies, influencers, or those working in sensitive fields who might end up losing their reputation and livelihood due to hacks.
But after an unprecedented AI-enabled hack impacting one of the world’s most valuable tech companies, Instagram users want to see Meta taking responsibility with more than just a few tweets.
Published – June 06, 2026 08:34 am IST
