Hackers trick Meta AI support chatbot into stealing celebrities' Instagram accounts

Hackers exploited Meta AI support with prompt injection and VPN spoofing to take over Instagram accounts.

The flaw let them trigger email changes and password resets, leading to widespread account breaches from February 2026.

Some compromised accounts were reportedly sold on gray markets until Meta fixed the issue on May 29.

The case highlights how weak permissions and authentication in AI support bots can enable high-impact account hijacking, including celebrity accounts.