Meta support AI: the recovery bot that handed over accounts
Meta's AI-assisted account-recovery chatbot could be talked into adding an attacker's email to an Instagram account and sending a verification code there, then offering a password reset. Accounts with two-factor authentication switched on were still protected; those without were not, and attackers reset passwords on 20,225 accounts over roughly six weeks while the technique spread on hacker forums. Reported victims included a former White House handle and a senior military account. Meta disabled the tool once it found the abuse. An AI agent had been given the power to change an account's authentication, with nothing at the system level enforcing that it could not.
What the verified record says.
- Organizations
- Meta; Instagram
- When
- April 17, 2026Resolved May 31, 2026
- Failure class
- Agent exceeded its authority agent-autonomy-exceeded
- Discovered by
- Researchers researcher Not caught by the organization running the AI
- Missing control
- Privilege separation. Permissions enforced by infrastructure, not by instructions. Full definition and the other incidents in this group → Watch this kind of control catch a planted failure →
- What would have caught it
- A hard rule that no AI agent can modify authentication factors without out-of-band human verification.
- Sources
-
- Help Net Security primary
- TechCrunch secondary
- Verification
- Adjusted: the incident is real, and details were corrected against the primary source before publication. The first reporting said the bot bypassed two-factor authentication. It did not: takeovers succeeded only on accounts without two-factor enabled, and the root cause, per Meta's counsel, was a separate code path that failed to verify the supplied email. The 20,225 figure and the April 17 to May 31 window come from Meta's breach filing with the Maine Attorney General. Verified against the primary source on August 25, 2026. Published on this site August 26, 2026, updated September 1, 2026.
This record is one of 26 in The receipts, each checked against a primary source before it is published. How the list is built →