Hackers Took 20,225 Instagram Accounts by Asking Meta's AI Chatbot Nicely

Twenty thousand Instagram accounts fell to a polite question

Between April 17 and early June 2026, attackers took control of 20,225 Instagram accounts without stealing a single password. They opened a chat with Meta's AI Support Assistant, the automated chatbot that handles account-help requests, and asked it to reset the password on accounts that were not theirs. The bot obliged.

What makes this worth your attention is not that a chatbot got fooled. It is that the chatbot was handed the authority to reset passwords, while the safety check meant to stop abuse sat in a separate piece of code that happened to be broken. The result was an account takeover anyone could perform by typing a request in plain English.

How the attack worked

Meta disclosed the breach in a notification filed with the Maine Attorney General on June 5, 2026. The stolen accounts included short, valuable usernames that resell on gray markets for hundreds to thousands of dollars, the dormant Obama-era White House handle, and the account of U.S. Space Force Chief Master Sergeant John Bentivegna, the service's highest-ranking enlisted member. TechCrunch published the first report on June 1, after a video of the full attack circulated on X.

The method was almost mundane. An attacker first used a VPN to appear in the victim's region, sidestepping Instagram's location-based fraud checks. They then told the AI Support Assistant to add a new email address to the target's account. The bot sent a verification code to that attacker-controlled address, the attacker read the code back to the bot, and the bot offered a "Reset Password" button. One click, and the account was gone. The flaw was a missing check. By Meta's own account, the system never confirmed that the email address the requester supplied actually matched the one on file for the account. The chatbot did exactly what it was told, and the guardrail that should have caught the lie was the part that failed. It only failed on accounts that did not have two-factor authentication (a second login step beyond the password, such as a code from an authenticator app) switched on.

• The attack window ran roughly seven weeks. Meta said on June 1 the issue was fixed, but hijacks continued the next day, and the chatbot was not fully disabled until the June 5 filing.
• Affected users had their contact details, dates of birth, posts, and direct messages exposed. Meta says it is "unaware" of what the attackers actually read.
• The only accounts spared were those with two-factor authentication enabled. Every account without it was one conversation away from being taken.

Why a support bot is now an attacker's easiest target

The concrete damage is on the record: 20,225 hijacked accounts, seven weeks of exposure, private messages and personal data in the hands of strangers, and government and military handles among the losses. For your own organization the lesson is sharper than "Meta made a mistake." Customer support, IT help desks, and account-recovery flows are exactly where companies are now placing AI agents, because the work is repetitive and expensive. The moment such an agent can perform a privileged action like resetting a password or adding a recovery address, it inherits the power of the human it replaced without the instinct that makes a person pause at a strange request. A help-desk worker might sense that something is off. The bot processed the request as routine. The systemic shift worth raising in your next review is structural. When the agent and the verification check live in separate code paths, a single bug in the check turns a friendly assistant into an authentication bypass that scales to every account at once. Attackers no longer need to break the lock. They ask the system that holds the key.

What to do about it

1. Turn on two-factor authentication, and prefer an authenticator app over SMS. In this breach, 2FA was the line between a safe account and a stolen one, and an app-based code resists the SIM-swap tricks that defeat text messages.
2. Never let an AI agent complete a sensitive action on its own. Require a separate, verified channel or a human approval before a bot resets credentials, changes a recovery email, or moves money, because the failure here was an agent trusted to act without an independent check on who was really asking.
3. Test your own support and recovery bots the way an attacker would. Ask them to do something they should refuse, like adding an unverified email to someone else's account, because the verification gap that sank Meta stays invisible until someone deliberately lies to the system.

Bottom line

The attackers did not defeat Meta's security so much as walk through a door it left open and labeled "support." A chatbot was handed the keys to account recovery, the check that was supposed to verify each request was quietly broken, and 20,225 people paid for it. As more companies route account recovery, help-desk work, and customer service through AI agents this year, the question to bring to your next planning meeting is simple. If one of your bots can reset a password or change a recovery address, what independent check confirms the person asking is who they claim to be? You can switch on two-factor authentication for your own account through Instagram's official two-factor setup guide.