Harmful outputPI-0089
Meta's AI support assistant let attackers hijack 20,225 Instagram accounts by linking their own email
News outlets reported on June 1, 2026, that attackers were taking over Instagram accounts through Meta's AI support assistant. Videos showed attackers using a VPN to appear near the target's location, then asking the chatbot to link the account to an email they controlled and requesting a password reset. Reports linked the wave to high-profile takeovers, including the dormant Obama White House account and Sephora's, though they could not confirm which accounts were taken this way; accounts with two-factor authentication were not taken over. In a breach letter to Maine's attorney general, Meta said 20,225 accounts were hijacked through its AI-assisted High Touch Support recovery system. Meta said the AI tool worked as intended and blamed a bug in a separate code path that did not check the email against the account. It disabled the tool and invalidated its reset links.
Harm level 2, Minor harmControl level 1, No rule broken
Counts in 4 weekly readingsEffect on the index
Sources
How we know
4 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- newsHackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked404 Media · June 1, 2026404media.co/hackers-simply-asked-meta-ai-to-give-them-access-to-high-profile-in…
- newsMeta's AI support chatbot made it ridiculously easy for hackers to take over Instagram accountsEngadget · June 1, 2026engadget.com/2185225/meta-ai-support-chatbot-made-it-ridiculously-easy-for-hack…
- newsOver 20,000 Instagram accounts stolen in Meta AI support hackBleepingComputer · June 8, 2026bleepingcomputer.com/news/security/meta-ai-support-data-breach-affects-20-000-i…
- newsHackers used Meta’s AI support system to hijack over 20,000 Instagram accountsHelp Net Security · June 8, 2026helpnetsecurity.com/2026/06/08/instagram-ai-support-vulnerability-account-takeo…
Why this rating
Minor harm; control failure level 1
Two separate assessments. Only documented harm can count toward the index.
Observed harm
Minor harmMeta says 20,225 Instagram accounts were taken over through password resets sent to attacker emails. It has no information on what personal data was accessed.
Privacy & data: Light harm to 10,000 to 10M people, serious harm to fewer than 100,000 (an account taken over, personal information published or taken), or sensitive data of fewer than 100.
Evidence eligible (confirmed).
Disputed: Meta says the AI tool functioned as intended and that a bug in a separate code path skipped the email check. Reporting describes the chatbot linking attacker emails on request.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
No rule brokenThe support assistant acted on unverified requests from attackers within the account-recovery powers it was given. Meta says the tool worked as designed and that the missing ownership check was in a separate code path.
No rule was broken, so it cannot set the control floor.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
Meta's breach letter, as reported, confirms that 20,225 Instagram accounts were hijacked through its AI-assisted recovery system. The victims were Instagram users, so the harm fell outside Meta. Each victim lost control of a social media account, which is limited, recoverable harm, and no exposure of sensitive data such as health or financial records is documented; what the attackers saw inside the accounts is not known. The harm sits at level 2. The assistant acted on unverified requests within the recovery powers it had been given, and the sources show no instruction it broke. Meta says the missing ownership check sat in a separate code path, so control stays at level 1. The breach and its count come from Meta's own letter, reported alongside independent coverage.
Effect on the index
It moved the June 1 reading from 2 to 20
The reading for the week to June 1, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Counts toward the index. 3 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | Yes | — |
| Worst documented harm, ksets the band | 2 Minor | — (none counting) |
| Harms at that level, nposition in the band | 1 | 0 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | 2 |
| Readingrounded down | 20 Minor harm | 2 Control failures only |
Counted in 4 weekly readings
| Week to | Reading | Band |
|---|---|---|
| June 1, 2026 | 20 | Minor harm |
| June 8, 2026 | 20 | Minor harm |
| June 15, 2026 | 6 | Negligible harm |
| June 22, 2026 | 6 | Negligible harm |
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 8, 2026
First published.
Cite and share
Use this record
Citation
Paperclip Index. “Meta's AI support assistant let attackers hijack 20,225 Instagram accounts by linking their own email.” Record PI-0089. Reported June 1, 2026; updated Oct. 8, 2026. Rated under methodology v0.8. https://paperclipindex.com/incident/PI-0089