Meta's AI Support Flaw: The 'Too Stupid to be True' Security Breach

A critical vulnerability in Instagram's AI support system allowed attackers to hijack accounts by spoofing locations and requesting email changes. This 'zero auth' exploit bypassed 2FA and identity checks, leading to the compromise of high-profile accounts and the rise of black market takeover services. While Meta has now patched the flaw, the incident exposes a significant lack of robust security oversight in their automated support systems.

Key Points

• Attackers used location spoofing and AI support manipulation to trigger unauthorized password resets.
• The exploit completely bypassed two-factor authentication (2FA) and identity verification measures like video selfies.
• High-profile accounts were successfully targeted, and the exploit was sold as a service on black market Telegram groups.
• The vulnerability existed because Meta's AI support lacked robust guardrails and didn't verify if new emails were previously associated with the account.
• Meta has since patched the vulnerability after it was active for potentially weeks or months.

Sentiment

The overall sentiment is strongly critical of Meta and broadly aligned with the article's warning. Most commenters treat the incident as a serious, preventable account-security failure and view Meta's AI support rollout as either the direct cause or a force multiplier for an already unsafe recovery design. The main disagreement is analytical rather than sympathetic to Meta: commenters debate whether to blame AI, backend authorization, support cost cutting, or organizational incentives, but they largely agree that the outcome reflects poor security engineering and weak user protection.

In Agreement

• Support and recovery paths are often the weakest link in authentication, and Meta's flow appears to have let attackers bypass protections that users reasonably expected to matter.
• A support AI should not be able to send verification or reset flows to arbitrary contact points; privileged identity operations need deterministic backend checks that cannot be overridden by chat output.
• Using AI in high-risk account recovery can amplify failure because the same bad behavior can be repeated at scale without human suspicion, institutional memory, or meaningful accountability.
• Meta's lack of reliable human support and appeal channels shifts the cost of security and moderation errors onto users, including users with businesses, private messages, contacts, and hardware tied to their accounts.
• Safer recovery patterns already exist, including waiting periods, notifications to existing contact points, recovery keys, trusted contacts, identity verification, and high-friction escalation for risky account changes.

Opposed

• Some commenters argued the core issue may not be AI but a broken account-recovery API or policy that would have been unsafe behind any interface.
• A few were skeptical of the article's claims because they wanted stronger proof or more detail about the actual implementation and preconditions.
• Some emphasized that recovery is inherently difficult because users really do lose passwords, devices, old emails, and identity proofs, so every recovery process must trade off lockout risk against takeover risk.
• A minority argued that social accounts are not as critical as banking or safety systems, though others pushed back that compromised accounts can still expose sensitive private data and enable real harm.
• Several noted that human support is also exploitable through bribery, laziness, or bad scripts, so simply replacing AI with humans would not solve the governance problem by itself.