Instagram says it fixed a flaw that allowed hackers to trick its AI support chatbot into changing account details. Here’s what happened, who was affected, and how to stay safe.
Table of Contents
What Happened?
The company said it has fixed the issue and is helping secure affected accounts.
Reports shared on social media showed that attackers could convince the chatbot to change the email address connected to another person’s account.
Once the email was changed, they could request a password reset and take control of the account.
Who Was Affected and What Data Was at Risk?
Meta has not publicly shared how many Instagram accounts were affected.
However, multiple users reported unauthorized password reset attempts. Among them was security researcher Jane Manchun Wong, who said her Instagram password was changed without her knowledge.
The issue also coincided with several high-profile account takeovers, including an Instagram account previously used by former President Barack Obama.
Meta has not said whether any personal information beyond account access was affected.
Access to an Instagram account can create serious problems. Criminals may use a hijacked account to impersonate the owner, send fraudulent messages, or access private conversations.
Even if you were not affected by this incident, your information could have appeared in data breaches or data leaks over the years.
If you are not sure whether your information was leaked, automatic monitoring can help you spot problems earlier.
Futureproof monitors your email 24/7 for data leaks and gives simple and clear steps to secure your email account from scams.
How Did the Instagram Account Takeovers Happen?
Reports suggest hackers abused Instagram’s AI support assistant during the account recovery process.
First, attackers selected a target account. They then used a VPN (a tool that can make it appear as if you are connecting from another location) to imitate the account owner’s location.
Next, they asked the AI chatbot to link a new email address to the target account. The chatbot reportedly completed the request and sent verification codes (special security codes used to confirm ownership of an account) to the attacker’s email.
After verifying the new email address, the attacker could request a password reset and take control of the account.
The incident shows a growing challenge with AI-powered customer support tools. If automated systems can make sensitive account changes too easily, attackers may find ways to misuse them.
Futureproof scans your data for leaks and shows exactly how to close security gaps — before scammers find them first.
Check my safetyYour Key Takeaway From the Instagram AI Account Takeover
This case shows that convenience can sometimes create new security risks.
More companies are replacing human support teams with AI systems. While these tools can help users faster, they may also become attractive targets if they are allowed to make important account changes without enough verification.
Never assume an online account is completely safe just because it belongs to a large company. Even trusted platforms can make mistakes, and attackers are often quick to exploit them.
Besides, account takeover attacks continue to cause significant financial losses. According to the FBI, cybercriminals stole more than $262 million through account takeover fraud in 2025, with more than 5,100 complaints reported to the agency.
Many of these attacks started with stolen login credentials, phishing messages, or fraudulent account recovery requests.
3 Ways to Better Protect Your Instagram Account
These simple steps can help reduce the risk of unauthorized access to your Instagram account:
1. Watch for unexpected password reset emails
Criminals often test account recovery systems before attempting a takeover. Repeated password reset emails can be an early warning sign.
If you suddenly receive password reset requests you did not make, change your password immediately and review your account security settings.
2. Secure your email account
Your email account connects to many of your online accounts. If someone gains access to it, they may be able to reset passwords elsewhere.
Use a strong password and turn on two-step verification for your email whenever possible.
If you are not sure how to strengthen your account security, the Futureproof Email Protection tool can help. Email Protection helps you create strong passwords and set up two-step verification to secure your account faster.
3. Review connected devices regularly
Sometimes attackers stay signed in even after a password change.
In Instagram, open Settings → Accounts Center → Password and Security → Where You’re Logged In. Review the device list and sign out of any device you do not recognize.
One Weak Security Check Can Put Your Account at Risk
While Meta says it has fixed the issue, the incident shows that even large platforms can make mistakes when introducing new technology.
Your account security requires both good habits and reliable systems working in your corner.
Using strong passwords, enabling two-step verification, and monitoring for data leaks with Futureproof can help reduce your risk and make it harder for criminals to gain access to your accounts.
At Futureproof, Kevin explains digital safety in simple words, with clear tips and zero fluff. He holds a degree in information technology and studies fraud trends to keep his tips up-to-date.
In his free time, Kevin plays with his cat, enjoys board-game nights, and hunts for New York’s best cinnamon rolls.
