In A.I. Blunder, More Than 34,000 Instagram Accounts Were Attacked
In A.I. Blunder, More Than 34,000 Instagram Accounts Were Attacked
The flaw, which Meta said it had fixed, allowed anyone to take over accounts using a bug in the company’s new artificial intelligence software.
https://www.nytimes.com/2026/06/09/technology/instagram-hack-ai-bug.html
Eli Tan
By Mike Isaac and Eli Tan
Mike Isaac covers Silicon Valley and Eli Tan covers Meta.
Published June 9, 2026Updated June 10, 2026, 12:46 p.m. ET
-snip-
Roughly 34,000 Instagram accounts were affected, including the accounts of the home security monitoring company SimpliSafe and a senior official in Mr. Trump’s Space Force department, according to internal Meta documents viewed by The New York Times. In the Space Force official’s case, hackers began posting pro-Iran messages comparing the war in Iran to U.S. involvement in Vietnam in the 1960s.
Of the 34,000 accounts, 20,000 were breached, giving hackers access to the related email addresses, phone numbers, birth dates and other personal data. More than 3,500 of the accounts had their user names taken over and changed from the hack, according to the internal documents. Meta has said it could not determine what information was viewed or stolen by the attackers.
-snip-
“Some of our internal back-end checks failed in this instance, but it wasn’t due to the A.I. agent itself, and we’ve addressed the underlying cause,” said Andy Stone, a Meta spokesman, adding that it was notifying regulators and people whose accounts were affected. The company said that because of its new automated customer service programs called agents, the number of users who were able to recover hacked accounts in the United States and Canada increased by 30 percent last year.
-snip-
Stealing high-profile social media accounts with millions of followers has long been lucrative. Hackers have found ways to trick users into giving up their handles through duplicitous messages or fake password resets, often reselling the handles to bidders like cryptocurrency promoters or political operatives. Buyers then use the accounts to spread messages for personal or political gain, or sometimes just to wreak havoc.
-snip-
In May hackers discovered a bug in a Meta customer service tool that allowed anyone to use an artificial-intelligence-powered chatbot to reset the passwords for Instagram accounts. "All the hacker had to do was ask the chatbot to change someone’s password — and it would be done."
This incident is just another A.I.-themed goof for Meta. Meta which also owns Facebook and WhatsApp, has based the company’s future on quickly shifting to an A.I.-first organization.