- An issue with the Instagram recovery tool, which uses AI from Meta Platforms Inc., allowed malicious actors to reset user passwords just by using a username and any email address.
- The error effectively exposed or allowed the takeover of approximately 20,225 Instagram accounts over a period of around six weeks, from the middle of April until the end of May.
- Meta later took the recovery tool offline, compelled users to reset their passwords, and is currently reviewing other account recovery systems.
A hidden security flaw in Meta’s account recovery system is raising concerns about how social media platforms are handling user security.
The issue involved an AI-powered support tool used for Instagram account recovery. It was supposed to help users get back into locked accounts. Rather, it created an opportunity for an attacker to seize the accounts.
The issue was not noticed for multiple weeks, and thousands of accounts were compromised before Meta discovered the issue.
A Simple System Error With Serious Consequences
Meta created a tool called High Touch Support or HTS. It used artificial intelligence to help Instagram users get back into locked accounts. The idea sounded smart. A user would enter an email address. The system would send a password reset link. Simple, right?
But the system missed one basic check. It was never verified if the email actually belonged to the account owner. That small mistake turned into a massive hole. Anyone could enter any Instagram username and just type in a random email they control and receive a password reset link on the account they wish to access.
The second they got their hands on the link, they’d just set up a new password and log in as if the account was theirs. Security vulnerabilities are surging across different attack vectors. Cybercriminals have launched a supply chain attack contest as major vulnerabilities and malware campaigns increase, highlighting the growing threat landscape.
If the poor victim didn’t bother with two-factor authentication? Yeah, there’s literally nothing in the way. It’s like leaving your front door wide open with a neon “come on in” sign.
Security researchers say this turned a helpful tool into an open back door. No hacking skills. If an attacker had at least a username and an email address, they could easily get into someone’s account.
How the Flaw was Being Exploited
The attack worked in five simple steps. First, pick a target Instagram username. Second, open the recovery tool. Third, enter your own email address. Fourth, wait for the reset link. Fifth, change the password and take over.
That gave attackers full control. They could read private messages. Post anything they wanted. And steal personal information like phone numbers and email addresses. They could even access linked services.
The flaw did not just affect everyday users. Researchers claim they accessed data tied to famous personalities. That includes soccer star Kylian Mbappé. Even Meta’s own CEO, Mark Zuckerberg, may have been exposed. The company has not publicly confirmed the exact extent.
Thousands Hit Before Meta Noticed
The flaw stayed active from around April 17 to late May. Meta only discovered the issue on May 31. That means the door stayed open for about six weeks.
During that time, attackers quietly exploited the system. Meta later confirmed the damage. Roughly 20,225 Instagram accounts were impacted. Some notices to users said only a small number were affected in certain regions. That suggests the damage varied by location.
Meta filed a notice with the Maine Attorney General. The filing explained the problem clearly. The system incorrectly sent password reset links to emails not tied to the account. Once attackers reset the password, they could log in unless two-factor authentication blocked them.
Meta Shuts Down the Tool
After discovering the flaw, Meta moved fast. The company shut down HTS completely. It disabled the recovery tool. It invalidated all reset links created through the flawed system. The forced password resets for affected users. It also required extra security checks on impacted accounts.
Meta says it is now reviewing other recovery systems across its platforms. The company wants to make sure similar problems do not exist elsewhere.
In public statements, Meta called this a vulnerability in an AI-assisted recovery system. It said the issue allowed unauthorized password resets. The company also confirmed it had secured all affected accounts and would notify users directly.
What this Means for You
Account recovery tools are often the weakest link in online security. They try to help users who get locked out. But they also need to prove someone’s identity. This case shows that the balance broke down completely.
Security experts have a clear message. Enable 2FA immediately, and never recycle weak passwords. Use unique and strong passwords for every account. Review your recovery email and phone settings regularly.
Because once someone takes over your account, getting it back is slow and stressful. Even when companies fix the issue quickly, the damage may already be done.
The HTS flaw proves that a small design mistake can lead to a huge security problem. A system meant to help users ended up helping attackers instead. Meta says the issue is fixed.
But it took them six weeks to detect this glitch. That’s not exactly comforting. Makes you wonder just how much faith users should really be putting in these automated and AI-driven support systems.
