Meta Confirms AI Account Recovery Flaw Exposed Over 20,000 Instagram Accounts

Meta has confirmed that a vulnerability in its AI-powered Instagram account recovery system allowed attackers to take control of more than 20,000 Instagram accounts. The flaw was found in Meta's High Touch Support (HTS) tool, which uses artificial intelligence to help users regain access to locked Instagram accounts.

Key Highlights

• Meta confirmed a flaw in its AI-powered Instagram recovery tool affected over 20,000 accounts.
• Attackers exploited the system to reset passwords and access accounts without two-factor authentication.
• Meta disabled the tool, notified authorities, and is strengthening verification before relaunching.

Vulnerability Impact and Discovery

Attackers exploited the flaw to obtain password reset links for accounts that did not have two-factor authentication enabled. This allowed them to gain unauthorized access to those accounts. Meta acknowledged the issue after weeks of complaints from Instagram users who reported being locked out of their accounts. Several high-profile accounts were affected, including the Barack Obama White House account, Sephora's Instagram account, and the Chief Master Sergeant of Space Force account.

Meta's vice-president of communications, Andy Stone, responded to an affected user on X, stating that the issue had been resolved and that the company was working to secure impacted accounts. The company formally disclosed the incident in a data breach notification filed with the Maine Office of the Attorney General. Meta discovered the vulnerability on May 31, 2026, and found that unauthorized parties had exploited the flaw to reset passwords on Instagram accounts. The breach may have started as early as April 17, 2026, which is believed to be the date of the first successful attack.

How Attackers Exploited the Flaw

According to reports by 404 Media, the HTS system failed to verify if an email address provided during account recovery was actually linked to the targeted Instagram account. Attackers convinced the AI support bot to associate a victim's account with a new email address under their control. They then requested a password reset and received the reset code, which allowed them to access the account. Screenshots and videos circulating on Telegram showed hackers interacting directly with the AI support assistant. In some cases, attackers used VPN services to match the account owner's location, making their requests appear more legitimate.

Meta told Maine authorities that 30 users in the state were affected. The company estimated that more than 20,000 Instagram accounts were impacted globally. Meta said it cannot determine exactly what information attackers accessed. However, compromised accounts may have exposed email addresses, phone numbers, dates of birth, profile information, photos, videos, Stories, direct messages, account activity records, and details of linked services.

Meta's Response and Next Steps

After discovering the flaw, Meta disabled the HTS recovery system and invalidated all password reset links generated through the tool. The company required additional security checks and password resets for potentially affected users before allowing them to regain access. Meta plans to strengthen its email verification process before relaunching the tool. The company is also reviewing similar recovery systems across its platforms.

The incident has increased scrutiny of Meta's efforts to replace traditional customer support with AI. Earlier this year, Meta expanded AI-powered support across Facebook and Instagram, allowing the system to handle password resets, account recovery, and security requests. The breach highlights the risks of relying on automated systems for critical security decisions without sufficient safeguards.