Instagram's AI Support Bot Handed Over Account Access to Hackers
Last weekend, Meta's AI support bot granted hackers access to multiple high-profile Instagram accounts by following their instructions to reset passwords. The accounts compromised included the former White House page from Barack Obama's presidency, cosmetic chain Sephora, and the chief master sergeant of the U.S. Space Force.
The attack method was straightforward. Hackers asked the bot to add a new contact email to a victim's account, confirmed the change with a code sent to that email address, then used it to reset the password. In some cases, a VPN to spoof the victim's location was all that was needed.
Meta launched the AI support assistant in March to help users reset passwords, regain account access, and report problematic content. These are not minor functions. Account recovery involves identity, security, and trust-responsibilities that companies once deliberately kept behind human review because the stakes were too high to automate.
The real problem isn't the security flaw
This breach reveals a management failure, not just a technical one. Meta had been replacing human judgment with automated processes across multiple functions simultaneously. The company reassigned thousands of employees into AI-related roles and used AI to automate risk assessments of updates, safety features, and content moderation-all tasks that previously required human review.
The support bot exploit arrived in an organization already committed to removing humans from critical decision-making processes.
AI customer service is scaling fast
Meta is not unusual for deploying AI support at scale. The global AI customer service market was valued at $12.06 billion in 2024 and is projected to reach $47.82 billion by 2030, growing at roughly 25.8 percent annually.
The business case is compelling. AI scales cheaply, requires no shift management, and doesn't call in sick. Studies show AI cuts response times by 37 percent and reduces operational costs by 35 percent. Around 80 percent of companies are either currently using or planning to adopt AI-powered chatbots for customer service by 2025.
Banks use it for dispute resolution. Airlines use it for rebooking. Telecoms route complaints through it. E-commerce platforms use it to handle returns.
What this means for your support team
The question isn't whether to deploy AI in customer service. The question is what authority you give it. Meta granted its bot the ability to modify account settings and confirm identity changes-functions that directly affect security.
Before automating a customer service task, ask: What happens if this goes wrong? If the answer involves account takeover, financial loss, or data exposure, human review should remain in the chain. Cost savings don't justify removing judgment from high-stakes decisions.
Learn more about AI for Customer Support and the broader considerations around AI Agents & Automation to understand how to implement these tools responsibly.
Your membership also unlocks:
