Meta's AI support chatbot helped hackers hijack Instagram accounts, including the White House's

Hackers successfully used Meta's AI support chatbot to hijack Instagram accounts through simple social engineering. The flaw let anyone gain access to another person's profile just by asking the chatbot to change the linked email address and reset the password.

How the exploit worked

Hackers posted videos on Telegram demonstrating the hack step by step. The attack began with a request to Meta's AI support chatbot. The hacker asked for help supposedly to regain access to an account, without providing sufficient verification. The AI system, which was not protected against social engineering, carried out every request.

The chatbot changed the email address linked to the target profile to the hacker's address. After that, all that remained was to reset the password through the standard recovery method: sending a confirmation code to the new email. Full control of the account then passed to the attacker.

The process was so simple that anyone could repeat it. The hackers did not even try to hide the method, sharing video evidence publicly.

High-profile accounts were hacked

The vulnerability affected not only ordinary users but also protected government profiles:

• The White House's official account @obamawhitehouse, with 10+ million followers
• The account of the Chief Master Sergeant of the U.S. Air Force
• Other high-profile corporate and government profiles

After taking over the White House account, the hackers began posting Iranian propaganda. The incident quickly drew the attention of global media and showed how vulnerable even the best-protected profiles were.

Meta's position and the fix

Meta promptly acknowledged the problem and said the vulnerability had already been fixed. The company confirmed that the exploit was indeed possible through the support function and that additional protections had been introduced.

"We have already patched this vulnerability,"

Meta said in an official comment.

However, the company stayed short on details. It remains unclear whether the chatbot's verification of account ownership has been improved, or whether the AI system's logic itself has been changed. Meta also did not disclose when the problem was discovered.

What this means

The incident exposes a critical weakness in the trust users place in AI systems. When even a protected U.S. government account can be hijacked with a few questions to a chatbot, it signals that AI support needs a fundamental rethink of its verification approach.

For ordinary users the lesson is clear: protect not only your passwords but also the email addresses linked to your accounts. Sharing personal data with AI chatbots demands maximum caution.

*Meta is designated an extremist organization and banned in Russia.