Meta's AI Customer Support Agent Exploited to Hijack Instagram Accounts

Reports emerged that malicious actors successfully hijacked Instagram accounts by exploiting Meta's AI customer support agent through a straightforward social engineering approach: they simply asked the agent to reassign accounts to email addresses under their control, and the agent complied. The attack required no advanced technical capability, relying instead on the agent's lack of sufficient safeguards against unauthorized account transfers. The incident comes amid broader industry focus on high-end AI security threats, particularly after Anthropic withheld its 'Mythos' model from general release due to its advanced hacking capabilities. Security observers note that this case demonstrates the danger of fixating on frontier-model threats while neglecting simpler exploits in widely deployed AI systems. As businesses offload more operational tasks to AI agents, the attack surface for such low-sophistication but high-impact exploits continues to expand. The episode raises urgent questions about what permissions and verification requirements should govern AI agents that can take consequential actions on users' accounts.