Meta has notified at least 20,225 people that attackers compromised their Instagram accounts through a flaw in an AI-assisted recovery system. A breach notice filed with Maine’s attorney general says 30 affected users were in that state and identifies April 17 as the beginning of the campaign.
The vulnerability involved the email verification step for password resets. An attacker could supply an address not associated with the targeted Instagram account, and the system would send the reset link to that unrelated address rather than reject the request. The flaw affected accounts that did not have two-factor authentication enabled, according to the supplied security report.
Meta said the recovery tool itself performed its intended function, but a separate code path failed to compare the submitted email address with the one already recorded for the user. Once an attacker received the link, they could change the password and operate the account as its owner. Linked accounts could also be affected.
The breach notice lists contact information, birth dates, profile details, posts, direct messages and account activity among information potentially available after takeover. Meta said it was unaware what personal information, if any, attackers actually viewed. That distinction matters: a compromised account created access, but the supplied evidence does not establish that every category was extracted from every victim.
Meta removed the code path that allowed its chatbot to reset user accounts and temporarily disabled the chatbot. The company also said it was reviewing chatbots elsewhere on its platforms for similar weaknesses. Affected users were directed to reset passwords and authenticate again through verified channels. Reports of reset notifications appeared while some users said compromises were still occurring, making the final duration of the campaign unclear in the supplied account.
The incident illustrates how conversational interfaces can expose sensitive operations when natural-language flexibility reaches an authorization workflow. The core security failure was not that a chatbot could discuss recovery, but that the backend accepted an unverified destination for a credential-reset message. Strong recovery systems must bind any change to previously validated contact information or another independent proof of account ownership.
Two-factor authentication provided an additional barrier for the accounts described, but it does not excuse weak verification in the primary recovery path. Meta’s review of related systems will need to determine whether the faulty logic was isolated and whether logs can show what information was accessed. The breach count and technical explanation come from the company’s regulatory notice as reported by a security newsletter; the complete filing and any later revision were not supplied.
