What happened

Between March and May 2026, Meta widely deployed an AI support assistant across Facebook and Instagram to automate customer service and account recovery. 

Over the weekend of May 31, 2026, security researchers and threat actors revealed that the AI chatbot could be persuaded via basic text prompts to link existing Instagram accounts to brand-new email addresses provided by attackers. 

By using a VPN to spoof the victim's general geographic location, attackers bypassed automated safeguards and received one-time verification codes sent directly to their own email, allowing them to instantly trigger password resets and bypass non-SMS multi-factor authentication. 

Affected parties included everyday users as well as high-profile accounts, such as the former Obama White House account, U.S. Space Force Chief Master Sergeant John Bentivegna, retailer Sephora, and security researcher Jane Manchun Wong. 

Some accounts were defaced with pro-Iranian messages or listed for sale on messaging platforms. 

Why it happened

The root cause of the incident was architectural design flaws in how the conversational AI was integrated into Meta’s identity management infrastructure. 

The chatbot was granted elevated administrative privileges to execute sensitive actions (like modifying account emails and issuing password resets) without requiring out-of-band verification from the original account holder or deterministic authentication checkpoints. 

Meta relied heavily on location-based IP signals for verification, which were trivial to spoof via VPNs. 

Furthermore, Meta’s historical reliance on automated customer support and lack of accessible human fallback support channels severely restricted victims' ability to intervene or recover their compromised accounts quickly.