Hackers hijack Instagram accounts via Meta AI chatbot prompt injection, patch issued
Two independent outlets corroborate a prompt-injection attack on Meta's AI support chatbot that enabled email changes and account takeovers, with an emergency patch issued on May 29, 2026.
Prompt injection of Meta’s AI support chatbot enabled attackers to change account emails and seize high-profile Instagram accounts.
Key facts
- What
- Two independent outlets corroborate a prompt-injection attack on Meta's AI support chatbot that enabled email changes and account takeovers, with an emergency patch issued on May 29, 2026.
- Incident date
- May 1, 2026
- Who
- Meta Platforms, Inc.
- Failure mode
- Prompt Injection
- AI surface
- Chatbot
- Severity
- High
What happened
Hackers used a VPN to mask their location and engaged Meta’s AI Support Assistant in a chat, asking the bot to add a new email address to the target account and issue password resets. This allowed attackers to take over certain Instagram accounts, including government-related handles, and some were reportedly resold on the gray market for substantial value. Meta issued an emergency patch on May 29, 2026 to address the flaw.
What broke inside the model
- 01 · TriggerThe model reads retrieved or user-supplied text.
- 02 · Model stepThat text carries hidden instructions.
- 03 · Control gapNothing separates untrusted data from trusted commands.
- 04 · FailureThe injected instruction overrides the operator's.
- 05 · ConsequenceThe system acts on an outsider's intent.
At the injection point, retrieved text overrides the operator's instruction.
The exploit relied on prompt-injection to use elevated AI permissions for account-management actions, effectively bypassing normal security checks. The incident is framed as a 'confused deputy' problem where a high-permission AI is tricked into acting for a less privileged user.
What it cost
Sources
Cite this entry
https://failureindex.ai/failures/hackers-hijack-instagram-accounts-via-metaAI Failure Index. "Hackers hijack Instagram accounts via Meta AI chatbot prompt injection, patch issued" (FI-0318). Realm Labs. https://failureindex.ai/failures/hackers-hijack-instagram-accounts-via-meta (indexed Jun 8, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0318. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.