Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse

The social media giant has informed authorities about the impact of the recent attack involving an account recovery support tool. The post Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse appeared first on SecurityWeek .

According to Meta and external reporting, attackers abused an AI-powered Instagram account recovery tool / support assistant to hijack roughly 20,000 accounts by convincing the system to relink target accounts to attacker-controlled email addresses, then resetting passwords and locking out victims.[2][3][5] This reflects a classic 'confused deputy' or business-logic flaw: the AI agent had privileged API access to account management but did not robustly verify that the requester actually owned the account.[2] CyberSE.AI analysis: This incident shows how delegating high-privilege workflows (like account recovery) to AI agents without strict guardrails, step-up verification, and adversarial testing creates a powerful abuse path for attackers at scale. Organizations should subject any AI-driven support or recovery agents to rigorous business logic audits, red teaming, and authorization design reviews before and after deployment to prevent similar takeovers.