Meta's AI Support Bot Can Be Tricked Into Handing Over Instagram Accounts

Remember when kids would ring doorbells and run away? Hackers are now doing the same thing, but with Meta's AI support bot. And apparently, it works.

How It Works

A security researcher discovered that attackers can use Meta's AI bot to reset an Instagram account password. The bot is apparently so gullible that you just need to ask convincingly — and it will send a password reset link. No complex exploits, no phishing — just "hi, I'm the account owner, give me access."

Meta, of course, denies the issue, but there are already real cases of account takeovers. Their AI bot passed the Turing test but failed the common sense test.

Why It's Both Funny and Sad

Developers who've ever written support chatbots are now laughing nervously. We all know bots can be dumb, but this dumb? It's a new low — the customer is always right, even if they're a fraudster.

It's especially ironic that Meta spends billions on AI, and their bot ends up doing half the hackers' work. This must be a new kind of social engineering — AI engineering.

What to Do?

Until Meta fixes this bug, enable two-factor authentication and don't rely on the AI bot to protect your account. And maybe try contacting support yourself — who knows, maybe the bot will give you access to someone else's profile? Just kidding. Or not.

Studio METABYTE comment: We love AI, but trusting it with password resets is like asking ChatGPT to write code for a banking app. Want reliable authentication? We know how to ensure only the real owner gets access — not a bot with a poor sense of humor.