In 2026, attackers reportedly asked Meta's AI support assistant to link a new email address to a target Instagram account and then request a password reset. Reports say the bot relied on apparent location to verify users, which a VPN could fake. Meta said the issue was resolved. Accounts with two-factor authentication were targeted but not compromised.
What was reported
Engadget's report says hackers asked the assistant to change the email linked to a target account and then asked for a password reset. Because the chatbot relied on physical location to verify users, attackers used a VPN to make their location look like the victim's.
Meta has not said how many accounts were affected, and the exploit was reportedly discussed on Telegram since March, before it was patched. Reported targets included a dormant Obama White House account, a beauty retailer and a senior Space Force official. Meta's communications chief wrote that the issue was resolved and Meta was securing impacted accounts. Meta did not explain how the problem arose.
On two-factor authentication, resets could be requested on protected accounts, but attackers could not take them over. A later correction clarified that protected accounts were targeted but not compromised.
Why this class of failure matters
Account recovery is the weakest path into most accounts, because it must work for people who lost their password. If an AI agent can run recovery, it holds the same power as a support employee, and it can be talked into things at machine speed.
The reported weakness was not a code exploit. It was a business logic gap: a weak signal, location, was accepted as proof of identity, and an automated agent could make changes on request.
Design rules for AI in account recovery
- Do not let an agent change a recovery email or phone on the strength of a conversation alone. Require a strong factor that the real owner holds.
- Treat location, device name and writing style as weak signals, never as proof.
- Separate what an agent can look up from what it can change. Give it read access by default and gate changes behind verification outside the chat.
- Rate limit and alert on recovery attempts across accounts, since attackers run the same script many times.
- Notify the existing contact address and keep a delay before changes take effect.
- Log every agent action with the user it acted for, and review them.
- Test with red team prompts that try to talk the agent around the checks.
What users can do
Turn on two-factor authentication using an app or a security key. The reporting suggests protected accounts survived this attack. Keep recovery email accounts secure too.
For the agent side of the same problem, see MCP tool poisoning attacks in 2026.
Where Safeguard fits
Safeguard offers an MCP Guardrail and agent identity, which limit what tools an agent may call and tie actions to an identity. These help for agents you build. They are not controls inside another company's products. A free scan is at gold.safeguard.sh/scan.
Quick check
Why did a VPN matter in the reported attack?
The assistant reportedly used the user's apparent location as a check, and a VPN could make the attacker's location match the victim's.
Did two-factor authentication help?
According to Engadget's corrected report, protected accounts were targeted but not compromised.
Sources
Last reviewed: 19 October 2026.
