Hackers used Meta's AI chatbot to steal Instagram accounts.

Hackers used Meta's AI chatbot to steal Instagram accounts. All they had to do was ask. Meta's AI chatbot had back end access to account management. When a hacker started a conversation and asked to link account to a new email address, the chatbot did it with no password verification. It sent the verification code straight to the attacker's email. The Instagram accounts that were targeted were not random. Hackers went specifically after rare short usernames, also called OG accounts, that sell for thousands of dollars on the internet. Among the confirmed victims, the @obamawhitehouse account, @hey, @jowo, verified Sephora account, US Space Force official John Bentivegna, and security researcher Jane Wong, who confirmed on X that her account was taken without her knowledge. Researchers call it a confused deputy vulnerability. AI was the trusted deputy with elevated access to account management, but nobody gave it strict rules to verify who it was talking to. Meta acknowledged the issue and issued a fix restricting the chatbot's ability to make sensitive account changes. Any company deploying an AI assistant with direct access to account management faces the same exact risk. Follow for more, Cyber News.