Over 20,000 Instagram accounts have been hijacked due to a vulnerability in Meta’s AI-assisted account recovery support tool, known as High Touch Support (HTS). The flaw allowed attackers to obtain password reset links by exploiting the tool’s failure to verify that the email address requesting the reset actually belonged to the targeted Instagram account.
The attack exploited a logic flaw in the automated support workflow: when users contacted Meta’s AI support system claiming they were locked out of an account, the system would generate and send password reset links without properly cross-referencing the requester’s email against the account’s registered email address. This meant attackers could request resets for any Instagram account and receive the reset link at their own email address, effectively taking over the account without needing the original credentials.
The campaign primarily targeted accounts with significant followings, including influencers, small businesses, and content creators. Many victims reported being unable to recover their accounts through Meta’s normal support channels for days or weeks after the hijacking. Meta has since patched the vulnerability and is working to restore affected accounts.
Source
Security Boulevard · Check Point Research
Commentary
This is a case study in why you don’t let AI handle security-critical workflows without bulletproof verification. Meta’s High Touch Support tool was designed to improve the account recovery experience — a notoriously painful process on Instagram. But by automating the flow without proper identity verification, they essentially built an account takeover service with better UX than most phishing kits.
The 20,000+ hijacked accounts are bad enough, but the real damage is to trust. Instagram account recovery was already a nightmare, and now users have to wonder whether Meta’s own support tools might be used against them. This is the kind of AI deployment failure that regulators will point to when arguing for stricter oversight of automated systems handling personal data and account security. Speed and convenience are great, but not at the cost of basic security controls like email verification.