Instagram users locked out after Meta AI abused to steal accounts

Meta AI – Multiple Instagram users say attackers tricked Meta’s AI-powered support flow into verifying them as the legitimate owner, leading to sudden account takeovers. Victims describe being stuck in automated chatbot loops with no path to human help, even when they h

For several users, the moment the account vanished didn’t feel like a slow hack. It felt like a door closing from the inside.

On Monday, multiple Instagram account holders—many of them tied to rare or high-value profiles—reported suddenly losing access. Several said their identities were confirmed through facial scans and that they had already enabled safeguards such as two-factor authentication (2FA). Even so, the attackers ended up getting control, and in many cases victims said recovery proved nearly impossible.

A common thread in the reports: when people tried to fix the problem, Meta’s automated assistance appeared to trap them in an AI/chatbot loop. Users described being unable to reach human support agents and, in some cases, losing hours in a recovery process that never landed on a real solution.

Among the impacted accounts were one previously used by the Obama White House team, an account connected to app researcher Jane Manchun Wong (@hey), and accounts including @korn.

The owner of @korn said the band never officially claimed the account and said they were instead using another one. Even with that workaround, the recovery experience left them furious. “I spent 6 hours trying to get human support. and Meta’s support AI gave me 4 broken links in a row. ” explained a user identifying as Kornel.

Another user describing themselves as the @korn account owner added that the recovery mechanism consumed time without progress. “We’re at the point where one AI stole it, and another can’t fix it, zero humans in the loop anywhere,” they said.

The reported takeovers start with a familiar trigger: the attacker activates Instagram’s “forgot password” protocol after the account is treated as hacked. When Instagram’s AI-powered assistance asks for verification with a selfie. the attacker is said to use a photo from the target’s account and run it through an AI video generator to turn it into an animation. That generated face animation is then uploaded to Meta for verification.

User André said Meta’s AI accepts the verification because it can’t distinguish between a real selfie and an AI-generated video of someone’s face. André also said the method bypasses 2FA protections. “Then you try to recover your account, and you’re talking to a chatbot that has zero ability to help. You can’t escalate to a human. You’re just stuck. Your asset is gone, and there’s no one to call,” André said.

Some reports add another layer: attackers used VPN services to make their connection appear to come from the target’s usual region. The goal, according to those accounts, is to pass geolocation checks that would otherwise force a more complex login flow and additional security steps.

After changing the associated email address, the attacker can initiate a password reset and receive the security code needed to regain access. From there, the account can be controlled until the original owner is able—if they can—to complete recovery.

Not all claims about specific account names have been agreed on. Some online reports say attackers obtained the @e and @f one-letter accounts through an active exploit. while others dispute that. arguing those usernames were protected by an individual with internal privileges. BleepingComputer said it was not able to independently verify either explanation.

The reason those one-letter accounts matter is stark: because single-letter social media usernames are rare, they can be worth tens of thousands of U.S. dollars on the black market.

Meta has not published a press release with an official response to the incident. But the company’s vice president of communications, Andy Stone, replied on social media to an affected user, saying the “issue has been resolved, and we are securing impacted accounts.”

BleepingComputer said it contacted Meta for comment but had not received a response as of publication.

For victims, the dispute is about more than lost credentials. It’s about what happens after the attack—when the support system designed to help turns into a dead end.

Instagram Meta AI account takeover facial verification two-factor authentication chatbot support cybersecurity account recovery VPN