Instagram Meta AI Vulnerability Allegedly Enables Password Reset for Accounts

HomeCyber Security Instagram Meta AI Vulnerability Allegedly Enables Password Reset for Accounts By Guru Baran June 1, 2026 A critical flaw in Meta’s AI-powered account recovery tool on Instagram allowed attackers to hijack high-value accounts by tricking the chatbot into forwarding password reset codes with no verification required. Security researchers ZachXBT and Dark Web Informer were among the first to publicly expose the vulnerability, revealing that threat actors had found a way to manipulate Instagram’s Meta AI assistant a tool designed to help users recover access to their accounts. Attackers engaged the AI chatbot in conversation and prompted it to forward password reset codes to unauthorized parties, entirely bypassing identity verification checks. The flaw stemmed from insufficient controls in how the AI processed account recovery requests, effectively allowing anyone who knew a target’s username to initiate the takeover process. The exploit was not a traditional server breach Meta confirmed no backend systems were compromised. Instead, the vulnerability lived in the AI’s logic layer, which lacked proper rate-limiting or authentication enforcement before acting on reset requests. High-Value Instagram Accounts Targeted Attackers deliberately targeted premium, short-handle Instagram accounts, including high-profile usernames such as @hey and @jowo — known in underground markets for their resale value. 🚨 INSTAGRAM HAD AN EXPLOIT THAT ALLOWED YOU TO USE META AI TO RESET PASSWORDS TO ACCOUNTS WITH NO MFA ON THEM. THE EXPLOIT WAS PATCHED A SHORT TIME AGO.PIC.TWITTER.COM/PEUWLVMLLJ — Dark Web Informer (@DarkWebInformer) June 1, 2026 These coveted accounts, some valued at over $1 million combined, were quickly flipped through private Telegram channels before Meta could intervene. The speed of the operation highlighted how organized and financially motivated threat actors have become in exploiting social media platform vulnerabilities. Dark Web Informer confirmed the sales activity, tracking stolen account listings circulating across Telegram groups in real time — a tactic increasingly common in the account-takeover-as-a-service ecosystem. Meta moved to patch the vulnerability late Friday after reports surfaced online. In an official statement, the company said: “We fixed an issue that allowed an external party to request password reset emails for some Instagram users. There was no breach of our systems and people’s Instagram accounts remain secure. WE FIXED AN ISSUE THAT LET AN EXTERNAL PARTY REQUEST PASSWORD RESET EMAILS FOR SOME PEOPLE. THERE WAS NO BREACH OF OUR SYSTEMS AND YOUR INSTAGRAM ACCOUNTS ARE SECURE. YOU CAN IGNORE THOSE EMAILS — SORRY FOR ANY CONFUSION. — Instagram (@instagram) January 11, 2026 Despite the patch, the incident raised serious questions about the security architecture surrounding AI-assisted support tools and their access to sensitive account recovery functions. How to Protect Your Instagram Account Accounts protected by two-factor authentication (2FA) were not compromised during this attack. Security experts now strongly recommend the following steps: Enable app-based 2FA (e.g., Google Authenticator or Authy) instead of SMS-based verification. Use a private, dedicated email not publicly associated with your Instagram profile. Avoid reusing passwords across platforms; use a reputable password manager. Regularly review login activity under Instagram’s Security Settings. Store backup codes securely in case of emergency account recovery. Meta’s hasty patch underscores a growing concern: as AI tools gain deeper access to account management functions, their vulnerability to social engineering becomes a critical attack surface that demands far stricter safeguards. Free Webinar on OWASP API Top 10 and Guide to Close Visibility Gaps With WAAP Copy URL Linkedin Twitter ReddIt Telegram Guru Baranhttps://cybersecuritynews.com Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Trending News Hackers Abuse Trusted Google Domains to Hide Phishing Links From Email Gateways Microsoft Releases KB5089573 for Windows 11 to Fix Patch Tuesday Install Issues Hackers Use Fake Video Player Updates to Deploy Miner and RAT Malware Google Employee Charged for Making $1.2 Million With Confidential Information Hackers Push 22 Versions of npm RAT With Wallet Theft and Persistent Backdoor Latest News Cyber Security News Microsoft Releases KB5089573 for Windows 11 to Fix Patch Tuesday Install Issues Cyber Security News GitLab Patches Multiple Duo AI, DoS, and Authorization Flaws in Community and Enterprise Edition Cyber Security Pentest Swarm AI Tool With Live Access to nmap, sqlmap, Burp, Metasploit, and Others Cyber Security Google Chrome’s Device-Bound Session Credentials Now GA to Block Account Takeovers Cyber Security News GREYVIBE Hackers Leverage ChatGPT and Google Gemini to Fuel Cyberattacks