Meta AI Recovery Flaw Enabled Instagram Account Takeovers at Scale

Meta disclosed that attackers exploited a flaw in its AI-assisted Instagram account recovery system, known as High Touch Support (HTS), to reset passwords for accounts they did not own. Reporting tied the abuse to earlier takeovers of high-profile and valuable accounts including the archived Obama White House profile, Jane Manchun Wong, Sephora, a senior U.S. Space Force official, and sought-after short handles such as @hey and @jowo, some of which were briefly defaced or advertised for resale on Telegram. Multiple reports said attackers used VPNs or residential proxies to appear near a victim’s usual location, then manipulated Meta’s support workflow to add an attacker-controlled email address or receive a reset link without compromising the victim’s inbox.

Meta later said the vulnerable code path failed to verify that the submitted recovery email matched the email already associated with the target account, exposing 20,225 users between roughly April 17 and the end of May; successful takeovers were generally possible when victims had not enabled two-factor authentication. The company said it discovered the exploitation on May 31, disabled the HTS tool, invalidated reset links, forced affected accounts through security checkpoints and password resets, and plans to notify impacted users while reviewing similar recovery flows across its platforms. The incident drew broader scrutiny because an AI-driven support layer was allowed to perform privileged identity and recovery actions without deterministic verification, turning customer support into an account-takeover path.