Instagram AI Support Exploit: Zero-Auth Account Takeovers

Instagram AI Support Vulnerability Overview

Instagram recently suffered a critical security failure where its AI-powered support system allowed attackers to take over user accounts with virtually no authentication. By manipulating the support AI, attackers could redirect password reset codes to email addresses they controlled, granting them full ownership of high-profile and low-profile accounts alike.

The Account Takeover Process

The exploit followed a simple, multi-step flow that required only the target's username to initiate:

  1. Location Spoofing: Attackers used VPNs or proxies to mimic the target's city or region. This was done to avoid triggering security algorithms that flag requests from unusual geographic locations.
  2. AI Manipulation: The attacker contacted the Meta support AI, claiming the account was hacked. They requested that the verification code be sent to an arbitrary email address provided by the attacker, rather than the email associated with the account.
  3. Verification Bypass: The AI sent the security code to the attacker's email. The attacker then provided this code back to the AI, which the system accepted as proof of identity.
  4. Full Account Reset: Upon receiving the code, the platform provided a password reset link. This process revoked existing sessions and changed the password without notifying the original owner via email, text, or push notification.

In cases where Instagram's AI requested a video selfie for identity verification, reports indicate that AI-animated public photos taken from the target's own feed were often sufficient to bypass the check.

Impact on Security Measures

2FA Bypass

Because the system treated this recovery flow as a total account reset by the "true" owner, existing two-factor authentication (2FA) settings were bypassed and removed. Once the attacker gained control, they changed the linked email and phone numbers, leaving the original owner with no way to initiate a standard recovery process.

Targeted Accounts

The exploit was used to hijack high-profile accounts, including the obamawhitehouse and ocmssf (Chief Master Sergeant of the U.S. Space Force) accounts. Additionally, black market Telegram groups emerged to sell "account takeover" services, specifically targeting short, high-value handles (e.g., hey) which can be worth thousands or millions of dollars.

Technical Analysis and Community Insights

Technical observers and security researchers have highlighted several systemic failures in this implementation:

  • Privileged Tooling for AI: The AI agent was granted high-privilege write access to user accounts. Community members noted that the AI should have been limited to triggering a "send code" action to the existing registered email, rather than having the ability to specify a new recipient address.
  • Lack of Human-in-the-Loop: The vulnerability suggests that internal tools designed for human support agents—who are expected to follow a verification protocol—were given directly to an LLM without adding AI-specific guardrails.
  • The "Zero Auth" Problem: This is described as a "zero auth password reset," where the system assumes that the ability to receive a code at any email address proves ownership of the account.

"It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that... It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc."

Current Status

Meta has reportedly patched the vulnerability, and the activity in associated Telegram black markets has decreased. However, some users report that the exploit may still be active in certain regions or via specific methods, such as setting locations to Singapore. Some users who lost accounts during this window report extreme difficulty in recovering them due to the lack of human support staff to escalate the issue.

Sources