Meta's AI support chatbot handed over strangers' Instagram accounts to anyone who asked politely enough.
Over the weekend, attackers discovered they could instruct Meta's AI-powered customer support chatbot to add a new email address to accounts they didn't own. No phishing link. No malware. No access to the victim's original email. A video circulating on X showed the technique in practice: ask the bot to update account credentials, and it complied. That was enough to lock out the real owner and take full control.
The attack exposes a design problem bigger than any single bug. When a chatbot is granted real account-modification capabilities — the ability to change credentials, not just answer questions — it needs to verify identity before it acts. Meta's apparently didn't. The AI's helpfulness, the very quality it was engineered around, became the attack surface.
Meta has spent two years aggressively embedding AI into every layer of its products, including giving those systems real power over user accounts. That ambition now has a concrete cost. A support bot optimized to reduce friction is, by definition, optimized to reduce the friction attackers face too.