Executive Summary
Hackers exploited a confused-deputy weakness in Meta AI by simply asking the chatbot to link high-profile Instagram accounts to new email addresses.
What Happened
Exploiting a confused deputy weakness, the hackers simply asked the chatbot to link the account to a new email address. The post Meta AI Hands Over High-Profile Instagram Accounts to Hackers appeared first on SecurityWeek .
Affected Products
- Meta AI
Vulnerability / Attack Technique
Confused deputy abuse of an AI support agent
Technical Mechanism
The AI agent had authority to change account emails and did so on request without proper verification.
AI Security Category
LLM06:2025 Excessive Agency
Part of the AI Agent Excessive Agency topic.
Relevant Frameworks
RealGround Analysis
An agent with more authority than its verification could support. RealGround analysis: sensitive account changes must not be delegated to a chatbot.
Recommended Controls
- Remove account-ownership changes from AI support agents
- Require strong identity proof for recovery
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
securityweek.com: https://www.securityweek.com/meta-ai-hands-over-high-profile-instagram-accounts-to-hackers/
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.