Meta's AI-powered account recovery chatbot for Instagram, called 'High Touch Support,' was exploited by hackers from around April 17, 2026 until discovery on May 31. At least 20,225 accounts were compromised. The flaw: the system sent password reset links to any provided email address without verifying the email belonged to the account in question.
Potentially exposed data included contact info, birth dates, posts, direct messages, account activity, profile information, and linked services. Meta says it does not know which information was actually viewed by attackers.
Meta disabled the chatbot, removed the faulty code path, and invalidated all password reset links. Before reactivating the tool, the company plans to fix the email verification step and audit similar account recovery systems across all its platforms.
Summaries like this, in your inbox every morning.
Pick your industry and the AI tools you use, and get news related to your work every day.
Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.
