Back in December, Meta announced a new AI support assistant, promising that it would make the process of regaining access “faster and easier” for users who have lost control of their Facebook or Instagram pages. Now, it looks like Meta has even exceeded that promise.
Back in December, Meta announced a new AI support assistant, promising that it would make the process of regaining access “faster and easier” for users who have lost control of their Facebook or Instagram pages. Now, it looks like Meta has even exceeded that promise.
It seems that this is the AI assistant Meta support that hackers used to steal Instagram accounts on a massive scale. According to cybersecurity researchers, this AI tool made it as easy as possible for attackers to take over profiles — even two-factor protection proved powerless against it, writes Engadget.
Over the weekend, numerous cybersecurity researchers began to sound the alarm on the social network X about this exploit. According to them, detailed instructions on how to take over accounts were actively distributed on Telegram, as well as screenshots and videos showing the hacking process in action. Judging by these photos and videos, hackers simply asked the AI support chatbot to change the email associated with the desired account, and then requested a password reset.
Meta has now fixed the issue, although it remains unknown how many accounts were affected by the exploit before the patch was released. According to media reports, Telegram users have been discussing the vulnerability since March.
“This issue has been resolved and we are protecting the affected accounts,” Meta’s vice president of communications, Andy Stone, wrote on social media X.
While Meta didn't reveal details about how its AI assistant developed such a huge security hole, it appears that the hackers figured out that the chatbot relied on the profile owner's geolocation to activate support. As Neowin notes, for this now-removed exploit to work, the attackers simply had to turn on a VPN with the location of the person whose account they were trying to hack.
“Our systems recognize the device you typically use and familiar locations better than ever,” Meta wrote in its December blog post about the AI support tool.
While there is no official word on how many accounts were compromised using the AI tool, the timing of the attack appears to coincide with a wave of hacks of prominent public pages, including the Obama-era White House account. The page, which had been inactive since 2017, featured a neural network-generated image with a caption that TMZ says translates to "White House under Shiite control."
In a statement to the publication, Meta confirmed the hack, but did not provide any details on how it was carried out or who might be behind it. According to 404 Media, other victims who may have been affected by the exploit include cosmetics retailer Sephora and a senior US Space Force official.
