The photo-sharing platform Instagram has recently urgently fixed a major security vulnerability. Previously, multiple users' accounts were illegally hacked due to this vulnerability, and the core method used by hackers was tricking Meta's in-house AI customer service chatbot to easily gain control of victims' accounts.

High-profile and official accounts fell victim

Last weekend, many social media users reported that their Instagram accounts had been stolen. The victims included not only ordinary users, but also the official White House account from the Obama administration and the personal account of the Chief Master Sergeant of the U.S. Space Force, raising widespread concerns about the security of AI customer service.

Safety researcher Jane Huang was also one of the victims of this incident. She revealed that her login password was changed without any warning, and she received multiple requests for password resets from different locations on the same day, making the entire hacking process very alarming for users.

No need to break into user email accounts

According to a hacker operation video that spread online, the intrusion process of this vulnerability was highly deceptive. Hackers first used a virtual network to fake the target user's location, successfully bypassing the platform's automated risk control system, and then directly connected to Meta's AI customer service assistant.

In the conversation, the hacker tricked the AI customer service into binding a new email address to the target account. After the AI customer service sent a verification code to the new email and received the response from the hacker, it immediately displayed a password reset button, allowing the hacker to take over the account without ever breaking into the original email address bound to the victim.

Platform responds that the vulnerability has been fixed

Regarding this extremely serious AI logic vulnerability, an Instagram spokesperson later made a statement. Spokesperson Andy Stone said that the relevant security vulnerability has now been completely fixed, and the platform has resumed normal security controls.

However, the official did not disclose how many users were illegally hacked in this incident. Cybersecurity experts have warned that while AI customer service improves service efficiency, its permission verification logic still needs stricter supervision and review.