How a 'Confused Deputy' AI Chatbot Gave Away 20,000 Instagram Accounts

The root cause was a logic bug in a "separate code path" of HTS. According to Meta Associate General Counsel Amber Hannah, the tool "worked properly and functioned as intended" for its core tasks, but during password resets, the system failed to verify that the email address supplied by the person making the request matched the email address registered to the Instagram account. It sent the reset link to any address provided .

Security researchers instantly recognized this as a classic confused deputy problem: the AI agent was authorized to execute sensitive account operations through back-end APIs but lacked the fundamental logic to confirm the identity of the individual giving the command . As one analysis put it, the AI was "given permission to make account changes without being taught how to confirm the requester's identity" .

The Attack: A 6-Step Account Theft

The attack method was brutally simple. The exploit was first documented in a video circulated on Telegram on May 31, 2026, and involved nothing more than a chat conversation with Meta's own AI support assistant . Here is how it worked:

1. Target research: Attackers gathered the target's general geographic location, often from publicly available social media posts.
2. Location spoofing: They connected through a VPN with an IP address geolocated near the target's known region to avoid triggering Instagram's automated risk flags .
3. Initiating the flow: The attacker opened Instagram's standard password reset page and selected the option to chat with Meta's AI support assistant.
4. The ask: The attacker simply told the bot, "Link this account to my email address."
5. Bot compliance: The AI, lacking an identity-verification step, sent a one-time password reset code to the attacker-controlled email address .
6. Takeover complete: The attacker entered the code, reset the password, and locked out the legitimate owner .

This attack chain was successful against any account where two-factor authentication (2FA) was not enabled. The attackers who originally shared the exploit video explicitly confirmed their method failed against accounts with any form of MFA turned on .

The Fallout: High-Value 'OG' Handles, Brands, and Government Accounts

The scale and profile of the victims underscored how lucrative Instagram account theft had become. Of the 20,225 accounts hijacked, the most visible targets included:

• @obamawhitehouse: The dormant Instagram account from the Obama administration .
• Sephora: The official account of the global beauty retailer .
• John Bentivegna: The Instagram account belonging to the U.S. Space Force's Chief Master Sergeant .
• Rare 'OG' handles: Premium short usernames like single-character or highly desirable handles—including accounts like @hey and @korn—were systematically targeted because they command resale prices from thousands to hundreds of thousands of dollars on underground forums .

Researchers estimated the collective value of the stolen premium accounts listed for sale on Telegram exceeded $1 million, though Meta has not confirmed this figure . Several hijacked accounts were briefly defaced with pro-Iranian imagery before being locked down, adding a geopolitical wrinkle to the incident .

The vulnerability window stretched from at least April 17 to May 31, 2026—over six weeks of active exploitation before Meta's security team identified and patched the flaw .

Meta's Response: An Emergency Patch and a Broken Fix

Meta's response timeline was swift once the exploit became public, though it was marred by initial confusion:

• May 31, 2026: Meta identified the vulnerability and deployed an emergency patch the same day .
• Immediate actions: The company disabled the vulnerable HTS tool, invalidated all password reset links generated through the flawed workflow, and forced affected accounts through mandatory security checkpoints requiring password resets .
• Public comms stumble: On June 1, Meta spokesperson Andy Stone publicly stated the issue was "already fixed." However, additional victims—including security researchers—reported their accounts had been taken over through June 2, suggesting the initial patch was incomplete or that attackers were using a closely related variant .
• Formal breach notification: Meta filed a data breach notification with the Maine Attorney General's office, confirming the final tally of 20,225 affected users nationwide .
• Promised remediation: Meta committed to fixing the email verification logic before re-launching HTS and initiated a comprehensive review of similar account recovery flows across all its platforms .

It's important to distinguish this incident from a separate but concurrent vulnerability discovered on June 8, 2026, where a flaw in Instagram's web-based password reset flow exposed the unmasked email addresses and phone numbers of every Instagram user . That bug was unrelated to the AI chatbot logic flaw, but both surfaced in the same news cycle, creating initial confusion about the scope of each issue.

The Defense That Blocked Every Attack: MFA

If there is a single actionable lesson from this breach, it is the decisive power of multi-factor authentication. Even the weakest form—SMS-based one-time codes—functioned as a hard stop. The attackers themselves circulated this information, warning that their technique worked only on accounts without any form of MFA activated . The password reset exploit allowed login purely with a password; when a second factor was required, the attackers were locked out .

For anyone holding a high-value Instagram account—a brand, public figure, or owner of a short username—enabling MFA, ideally with a hardware security key or passkey, remains the single most effective security measure against this class of attack.

The Bigger Picture: AI as a Service, AI as a Risk

The High Touch Support incident is a cautionary tale for the rapid deployment of autonomous AI agents in customer-facing workflows. The AI was capable, it followed instructions, and it was connected to powerful back-end systems. But it was deployed without deterministic out-of-band authentication for sensitive actions—a foundational security requirement that human agents follow as a matter of routine. As organizations race to integrate AI support assistants across payment systems, account management, and sensitive data access, the Meta case serves as a reminder that access without verification is not automation; it is an open door.

Open Questions

• Has Meta re-enabled the High Touch Support tool with the promised identity verification fixes, and if so, what specific architecture changes were made?
• How many of the 20,225 hijacked accounts have been successfully restored to their original owners?
• Did Meta's broader review uncover similar verification vulnerabilities in Facebook or WhatsApp recovery flows?
• Was the U.S. Space Force account the only government-affiliated compromise, or were other sensitive accounts affected but not publicly disclosed?

Correction note: An earlier version of this article stated attackers bypassed 2FA. The exploit only worked against accounts without MFA enabled; the password reset gave attackers a new password, but any active second factor blocked login .