Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

this.weekinsecurity.com

Post reply on HN
Print view View original

101–110 of 287 posts

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#101

Post by dboreham »

Cyan488 wrote: post #3

> "The tool itself worked properly and functioned as intended; however due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account," said Meta in its breach notice. I'm not sure "worked properly" and "as intended" accurately describe this situation.

There should have been a test case for this. There wasn't because most shops don't actually test their product. They do some test theater such as unit testing.

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#102

Post by stephenhuey »

Cyan488 wrote: post #3

> "The tool itself worked properly and functioned as intended; however due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account," said Meta in its breach notice. I'm not sure "worked properly" and "as intended" accurately describe this situation.

What was that mantra? Something about broken software is what they aim for?

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#103

Post by Aurornis »

webbdev wrote: post #29

Meanwhile an account I created for a new product was permanently disabled by an automated system with no path for me to appeal to a human. (If anyone at Meta/Instagram sees this I wrote a brief blog post with the details. Please help! https://addisonwebb.com/blog/2026-06-05-Can%20Someone%20at%2... )

> Meanwhile an account I created for a new product

Meta requires the main account to be created for a person, not a product, business, or non-human entity. That's why you got hit with the "Please confirm you are a human" confirmation and then the account was locked for violating community standards, which require primary accounts to be people.

The community standards page in the links they sent you are pretty dense and it's easy to think you're not violating anything if you're not posting adult content and the other obvious categories. This is the section you violated:

> Create an account that represents a non-human entity, such as a business, pet, or fictional character

You have to follow the steps to set up a business page from your personal account. Sorry you didn't know this before going through the process, but it's important to read the proper channels for setting up business pages on all of the social media platforms these days. They're all dealing with an onslaught of spam and scam pages and they're under a lot of pressure to keep them out.

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#104

Post by Aurornis »

jjcm wrote: post #80
webbdev wrote: post #29

Meanwhile an account I created for a new product was permanently disabled by an automated system with no path for me to appeal to a human. (If anyone at Meta/Instagram sees this I wrote a brief blog post with the details. Please help! https://addisonwebb.com/blog/2026-06-05-Can%20Someone%20at%2... )

This is extremely common, unfortunately, to a point where it's a known/expected outcome when you're first creating a brand or product page among those in the biz. If this doesn't work, I'd encourage you to reach out to a brand/ad agency and pay them $100 to ask their meta contact to help you get unblocked. You pretty much have to know someone who knows someone at meta in order to create these. Tip: Do not post about…

> If this doesn't work, I'd encourage you to reach out to a brand/ad agency and pay them $100 to ask their meta contact to help you get unblocked.

I would not recommend paying anybody anything for this. The problem was that they tried to create an account for a non-human entity, which is against the rules. You have to have a primary account set up for a person, not a business.

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#105

Post by sieabahlpark »

johnyzee wrote: post #81

"Meta notified at least 20,225 people that their accounts had been compromised. [...] The compromises allowed the hackers to take over the person's entire Instagram and any linked accounts, including obtaining contact information, dates of birth, and profile information, as well as the ability to access the person's posts, direct messages, and account activity [...] the hacks began around April 17 and lasted until th…

[dead]

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#106

Post by prox »

jjcm wrote: post #80
webbdev wrote: post #29

Meanwhile an account I created for a new product was permanently disabled by an automated system with no path for me to appeal to a human. (If anyone at Meta/Instagram sees this I wrote a brief blog post with the details. Please help! https://addisonwebb.com/blog/2026-06-05-Can%20Someone%20at%2... )

This is extremely common, unfortunately, to a point where it's a known/expected outcome when you're first creating a brand or product page among those in the biz. If this doesn't work, I'd encourage you to reach out to a brand/ad agency and pay them $100 to ask their meta contact to help you get unblocked. You pretty much have to know someone who knows someone at meta in order to create these. Tip: Do not post about…

Or just leave the pile of crap behind. The more we do, the less the whole system matters. Never been happier since I left last year.

And yes I can already hear the reply the “we need it for…” , sure as a company if you feel you need it. As an individual however, it’s time for the next thing. TikTok, Instagram and Twitter are old and worn and not it. Yesterday’s news. Social media couldn’t be less social if they tried.

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#107

Post by thrownthatway »

lelandfe wrote: post #58
rothfuss wrote: post #42

Earlier quoted context omitted.

I was reminded of the Murray Walker quote. “There's nothing wrong with the car except it's on fire”

My dad says, "But other than that, Mrs. Lincoln, how was the play?" (Usually said jocularly when everyone is at their most upset, e.g. a vacation ruined)

[dead]

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#108

Post by thrownthatway »

vb-8448 wrote: post #30
Cyan488 wrote: post #3

> "The tool itself worked properly and functioned as intended; however due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account," said Meta in its breach notice. I'm not sure "worked properly" and "as intended" accurately describe this situation.

In italian we say "l'operazione è riuscita perfettamente, ma il paziente è morto" -> "the surgery was a complete success, but the patient died"

[dead]

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#109

Post by albedoa »

csallen wrote: post #59
nvme0n1p1 wrote: post #38

Earlier quoted context omitted.

In that case, the statement is so meaningless as to be useless. Why should we care how Meta splits up their microservices? The tool still failed. They just want to redefine the "tool" as something else, anything else, to avoid having to admit something negative about their precious AI. > The LLM correctly generated tokens according to user input, however due to a bug in a separate code path, the system did not proper…

I mean, I think many of us are curious and enjoy hearing more details about how and where bugs like this occur. What's wrong with that?

There is nothing wrong with that, and nobody is saying there is. In fact, it is exactly what is being requested here!

Re: Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot

#110

Post by Aurornis »

basisword wrote: post #67
webbdev wrote: post #29

Meanwhile an account I created for a new product was permanently disabled by an automated system with no path for me to appeal to a human. (If anyone at Meta/Instagram sees this I wrote a brief blog post with the details. Please help! https://addisonwebb.com/blog/2026-06-05-Can%20Someone%20at%2... )

They're awful with this. Any time I try to create an account to use for business purposes I'm asked for id within minutes and then they still ban the account. You need to fun everything through your personal account.

> Any time I try to create an account to use for business purposes I'm asked for id within minutes and then they still ban the account.

That's because they require accounts to represent an individual. They're pretty clear that it can't be for a business or a non-human entity. You can set up a professional account from your personal account, but the account has to be for a person.

Post reply on HN