Summary: 404 Media reported on June 1, 2026 that attackers used Meta’s AI support bot to claim ownership of Instagram accounts, rebind emails, and reset passwords without human review. TechCrunch reported on June 3 that Instagram had begun notifying targeted users, and Meta said the issue had been fixed while not disclosing how many accounts were affected. The article concludes that recovery authority must match verification strength and include human appeals.
404 Media broke the story on June 1, 2026, and the technique sounds almost too simple to be real: an attacker opened a chat with Meta’s AI customer support bot, declared that someone else’s Instagram account belonged to them, and asked for that account to be linked to an email under the attacker’s control. The bot did as it was told. No Meta employee or contractor ever entered the process, and afterwards victims had no route for handing the case to an actual person.
Two days on, June 3 brought a TechCrunch report that Instagram had begun notifying the users in the attackers’ crosshairs, with Meta saying it had “detected some suspicious activity that suggests your Instagram may have been compromised.” The episode also throws light on an architecture choice the industry is hurrying to copy: hand an AI agent the power to recover accounts and reset passwords, and however rigorously that agent verifies identities sets the security ceiling for the entire system.
The Method: Social Engineering, Aimed at a Chatbot
Almost no technical skill was involved. In videos and screenshots from Telegram hacking groups that 404 Media examined, the attacker simply messaged the bot with the target’s username and an email of their own — in spirit, “just link my new email address, this is my username” — then entered a verification code, and the linkage was made. A password reset followed, ownership changed hands, and the legitimate owner found themselves locked out.
Context is everything here. March 2026 saw Meta extend AI support to Facebook and Instagram, with copy promising “solutions, not just suggestions” and account issues handled “from start to finish” — your password included, reset securely. The agent, in other words, was built to carry out sensitive account-level operations. Its identity checks, plainly, were never equal to that authority — and users had no way to insist on a human being.
Famous Victims and the Underground Trade in OG Handles
The roll call of victims shows how far the blast reached. The dormant Instagram account of the Obama White House was reported compromised around May 31, apparently through the same technique (Meta contests that account of events). The account of Chief Master Sergeant John Bentivegna of the U.S. Space Force — the branch’s top enlisted guardian — was seized by pro-Iran hackers on the evening of May 31 and held for several hours; pro-Iranian artwork and stories went up before being taken down by 1 a.m. ET Monday, and a Space Force spokesperson confirmed the account had been breached. Sephora’s account, too, was reported among the casualties.
Ordinary users, though, made up most of the victim pool, and the pull is the gray market in “OG handles” — short usernames built from common first names and country names that have carried real price tags on the underground market for years. In a Telegram channel, hackers swapped notes on the method and shopped the stolen goods, while on X a running stream of users complained publicly about having their accounts snatched.
What Meta Has Said — and What It Hasn’t Answered
Speaking on Monday, Meta spokesperson Andy Stone said that “the issue that did happen has already been fixed,” adding that “some people may receive password reset notifications” and that security questions would greet other users at login. On the same day, Meta locked down the affected accounts first and only then sent the password reset emails — the very wave of notifications press coverage picked up on June 3.
Yet two things remain unexplained. Meta will not put a number on how many users were caught in this — no figure has surfaced anywhere. And at the time TechCrunch published, the Telegram channel still hosted chatter about the method and listings offering stolen handles, with TechCrunch cautioning that not every reported takeover can be pinned to the same route. “Fixed,” at this stage, rests on Meta’s say-so.
What AI Support Agent Builders Should Take From This
Teams plugging an LLM into customer support should study every step of this case. Take one: verification has to rise to the level of the authority granted. If an agent can rebind email addresses and reset passwords, it must demand identification as rigorous as any human agent would — a user’s word that an account is theirs proves nothing, and social engineering a model costs so little it can be retried endlessly. Take two: having no route to a human is itself a design defect. Victims told 404 Media they could find no appeals channel — which is exactly why the attacks ran their course unnoticed. Take three: actions of this sensitivity call for anomaly detection. An account whose email gets rebound and whose password gets reset within minutes should set off an automatic block, no matter who — or what — signed off.
Step back and AI security is being squeezed from two directions at once. Also this week, Anthropic’s analysis of AI-enabled cyber threats documented attackers folding AI into the later stages of their attack chains. Meta’s case supplies the other half of the picture: AI agents sitting on the defense side are attack surface as well. Both ends of the perimeter are expanding together.