Security breach in Meta support AI already affects 34,000 Instagram accounts

The number of Instagram accounts affected by the security breach in the artificial intelligence (AI) responsible for resetting Meta passwords, which was initially estimated at a total of 20,000, has now risen to 34,000 accounts, although Meta continues to opt for using this system.

Last week it emerged that a flaw in Meta’s password reset system allowed the company’s new artificial intelligence support assistant, officially launched in March in the United States and Canada, to be used to steal high-profile Instagram accounts, with just ask the chatbot to change the email address associated with the target account.

Specifically, the error was due to a bug in a separate code path, whereby the system did not verify that the email address provided matched the email address associated with the account of that user’s Instagram, as Meta herself explained at the time.

After this, it was shared that the total number of users who were affected by this breach amounted to 20,225 and they were, precisely, all those who did not have two-factor authentication (2FA) activated in your accounts. Now, according to internal documents accessed by The New York Times, it has become known that the The number of accounts affected by the same bug has increased to a total of 34,000.

The documents have also shown that, among the 34,000 affected accounts, are the former social media account of the White House of former President Barack Obama or that of the home security monitoring company SimpliSafe. Likewise, the aforementioned media has confirmed that around 20,000 of these accounts were compromised with access to personal datawhich include everything from the email address and telephone number to the date of birth, among others.

They have also been able to learn that The attackers managed to modify the username of 3,500 accounts. This means that the original ‘handler’ (username) was released and anyone could register it instantly. As The New York Times has recalled, the valuable ‘handlers’ – the short ones with millions of followers – They become a very lucrative asset if resold to cryptocurrency promoters or political operators.

Furthermore, it must be taken into account that, once someone has used the ‘handler’, recovering the account involves many difficultiessince Meta cannot return the username because it now occupies another account and requires a more laborious process than a simple password reset.

META COMMITS TO CONTINUE USING AI SYSTEMS DESPITE THIS FAILURE

At the beginning of these incidents, the company assured that the failure was not due to the AI ​​assistant itself, but because some of the internal ‘back-end’ checks failed. Likewise, Meta spokesperson, Andy Stone, assured that they have already solved “the underlying cause.”

Now, Meta’s spokesperson continues to defend these systems, claiming that, thanks to new AI-powered support programs, the number of users who managed to recover hacked accounts in the United States and Canada it increased by 30 percent last year, according to statements to the aforementioned media.

Likewise, according to internal documents, Meta agreed after the hack, “to leave all AI products active and only pause the current experiment (IG Forgot Password Chat)”.

This security breach has revealed the problems facing AI agentsas happened with Salesloft Drift in August 2025, an incident that affected more than 700 organizations, including cybersecurity companies such as Cloudflare, Palo Alto Networks and Zscaler. In fact, Cloudflare responded to what happened with a post on its blog. Unlike the Meta case, Salesloft pulled the plug on Drift completely.