Meta's chatbot worked exactly as designed.

Meta has told Maine’s attorney general that at least 20,225 people had their Instagram accounts hijacked through its AI chatbot, 30 of them in Maine. The breach notice, filed late Friday, is the first number the company has attached to a campaign that ran from around April 17 until this week, when Meta says it secured the tool.

The mechanism is simple enough to be uncomfortable. Instagram’s account recovery included an AI-assisted path: someone locked out could ask the chatbot to send a password reset. The reset link was meant to go to the email on file for the account. Instead the system sent it wherever the requester said to. Ask for the link to go to an address you control, and it went there. From that link you reset the password and took the account, along with any linked accounts, contact details, date of birth, posts, and direct messages.

Meta is specific about where the fault sat. “The tool itself worked properly and functioned as intended,” the notice reads. The failure was “a bug in a separate code path” that “did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account.” When someone supplied an unassociated email, the system “incorrectly sent a password reset link to that unassociated email rather than rejecting the request.”

That is an authorization check that was never run. The chatbot was a faithful front end to a backend that let the requester name their own destination for a password reset. The language model did what it was asked. The security property that failed lived underneath it, in the reset code.

For anyone putting a conversational interface in front of a state-changing operation, the interface does not change what the operation has to verify. Whoever requests a password reset still has to prove control of the account’s registered email before any link is sent, and that check has to run in the reset path itself, server-side, independent of whatever the model collected or relayed. A chatbot that “handled” the request is not evidence that the request was legitimate.

The flaw let anyone reset the password of any account that did not have 2FA switched on. Having two-factor authentication enabled kept an account out of the scope of this particular bug. If you run Instagram-linked automation or manage accounts at scale, that setting was what stood between an account and this reset path.

Meta says it has disabled the chatbot, removed the code path that let it reset accounts, and is checking other chatbots across its platforms for the same gap. It says it is “unaware” of what personal information was accessed during the hijacks, and did not answer a press query seeking clarity. Affected users were told to reset their passwords and re-authenticate through verified channels; some reported the takeovers were still happening as those notifications went out.