The Instagram chatbot hack, over 20,000 accounts compromised with no phishing and no malware
Listen to the audio version
The articles on phishing and social engineering on this site describe attacks that manipulate a person. The incident revealed in June 2026 around Instagram is different: nobody was deceived, no victim clicked on anything. It was a support chatbot that was manipulated, not a human being.
What happened
Between April 17 and early June 2026, attackers exploited a flaw in the Meta AI support chatbot to take over other people's Instagram accounts. According to a data breach notice filed with the Maine Attorney General's office, at least 20,225 people were notified that their account had been compromised this way. Affected accounts included the Obama-era White House account, inactive since 2017, the Sephora account, and several accounts belonging to US military personnel. Meta has since fixed the flaw.
How the attack worked, technically
The attack began in an ordinary-looking way: the attacker triggered a password reset request on the targeted account, an action anyone can carry out on any account, since it requires no secret information to start. The attacker then opened a conversation with the Meta AI assistant, the platform's official support chatbot, and asked it to link a new email address to the targeted account.
That's where the flaw sat. The chatbot was supposed to check that the email address provided by the person making the request matched the one already registered on the account in question. Because of a bug located in a separate part of the code, that check wasn't performed correctly: the verification code was sent to the address the attacker himself provided, rather than to the account holder's real address. Once that code was received and handed back to the chatbot, a password reset button appeared, allowing full takeover of the account.
Not a single step in this chain required a phishing link (see the dedicated article), malware, or any access at all to the victim's real inbox. The attacker needed to deceive no one: just know what to ask the right official tool.
Why two-factor authentication made all the difference
One detail of this incident directly confirms what the article on two-factor authentication explains in detail: accounts protected by two-factor authentication weren't vulnerable to this specific attack. Even after gaining full access to the password reset through the chatbot, an attacker would have run into the request for the second factor, a code or confirmation that only the real account holder, not the attacker, could provide without also having access to their device or app. This incident, then, affected, almost by definition, mostly accounts that hadn't turned on that protection.
What this reveals about new AI-related risks
This incident belongs to a category of risk still barely documented on this site: manipulating an automated system rather than a person or ordinary software. Companies are increasingly delegating sensitive actions, like account recovery, to automated conversational assistants, on the assumption that a chatbot follows strict, verifiable rules. Here, it wasn't the password, the device, or the person that was the flaw: it was the internal logic of a tool meant to perform a check, which simply didn't apply it correctly in one specific case.
This kind of flaw can't be fixed with an antivirus or better individual vigilance, since nothing in the victim's behavior was at fault. Responsibility rests entirely on the reliability of the automated system the company itself put in place, a reminder that delegating a security check to artificial intelligence doesn't automatically make it more reliable than a human check, only different in how it can fail.
What this actually changes
This incident doesn't call Instagram or the usefulness of support chatbots in general into question: Meta fixed the flaw, and this kind of logic bug remains, by nature, rarer than a simple mass phishing attempt. What it does confirm, though, is the very concrete value of a protection already recommended on this site: turning on two-factor authentication on an account isn't just one precaution among others for this kind of scenario; it's literally what stopped the takeover from working, even after every other step of the attack had already succeeded.