Meta AI Recovery Tool Flaw Exposed 20,000+ Instagram Accounts


Meta AI Recovery Tool Flaw Exposed 20,000+ Instagram Accounts

Pierluigi Paganini
June 08, 2026

A flaw in Meta’s AI-powered Instagram recovery tool exposed over 20,000 accounts, letting attackers reset passwords and take over profiles.

Meta’s High Touch Support tool, known as HTS, was designed to help Instagram users recover locked accounts: you provide an email address, you get a password reset link. The flaw was equally simple: the tool never checked whether that email actually belonged to the account being recovered. Anyone could request a reset link for any account, have it land in their own inbox, and walk straight in, provided the target hadn’t enabled two-factor authentication.

The breach occurred from approximately April 17, 2026 until Meta pulled the tool in early June. That’s roughly seven weeks of an open door, and Meta only discovered the problem on May 31. The operation ran undetected for about six weeks before anyone inside the company noticed, which is a detail that tends to get buried under the headline number.

Meta disclosed that 20225 Instagram accounts were compromised after attackers exploited the flaw.

“We are writing to inform you that a vulnerability in an Instagram account recovery support tool was used to potentially compromise the Instagram accounts of 30 users in your jurisdiction.” reads a data breach notice filed with Maine’s Office of the Attorney General, Meta. “All accounts have been secured to prevent any continued unauthorized access.”

The mechanism is worth understanding precisely. The HTS tool sent password reset links to whatever email the requester supplied, without cross-checking it against the account’s actual registered address. Once an attacker reset the password that way, the original owner was locked out. What the attacker then had access to was everything: contact information, date of birth, direct messages, posts, stories, account activity, profile data, and any linked external services. Not a partial exposure. The whole account.

“On May 31, 2026, Meta discovered that there was a vulnerability in an AI-assisted account recovery system for Instagram (‘High Touch Support’ or ‘HTS’) that was exploited by unauthorized third parties to perform password resets on Instagram user accounts.” continues the notice. “As a result, when an individual provided an email address not previously associated with the account, the system incorrectly sent a password reset link to that unassociated email rather than rejecting the request. This allowed unauthorized third parties to receive a password reset link for accounts they did not own. Upon resetting the password, the unauthorized party was able to log in to the account if the account holder had not enabled two-factor authentication (2FA).”

Once discovered, Meta moved quickly: it disabled HTS entirely, invalidated every reset link the tool had generated through the vulnerable path, enrolled all potentially affected accounts into a mandatory security checkpoint, and forced a full password reset and re-authentication for everyone impacted.

The fix before relaunch is straightforward in principle and embarrassing in retrospect: verify that any submitted email address matches the account on file before generating a reset link. That check should have been there from day one. Meta is also conducting a review of similar account recovery flows across all its other platforms, which implies the company isn’t fully confident HTS was the only tool with this kind of gap.

On user notification, Meta’s filing was careful with language. “As soon as practical, Meta intends to send user notifications to the potentially impacted users to inform them of this incident, recommend that they review their account security settings, and enable 2FA.”

Meta plans to notify potentially affected users and encourage them to review their security settings and enable two-factor authentication. California Attorney General Rob Bonta and 39 other state attorneys general urged Meta to strengthen its protections against account takeovers, calling current measures insufficient.

This isn’t Meta’s first appearance in this sequence. Ireland fined the company $264 million over a 2018 Facebook breach exposing 29 million accounts, €265 million in 2022 for failing to protect user data from scrapers, and another €91 million for storing hundreds of millions of passwords in plaintext.

The HTS incident adds a new entry: an AI support tool deployed in a security-critical context, performing privileged account actions, without the most basic identity verification in place. The tool was designed to help users get back in. It turns out it was equally good at helping strangers do the same.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Meta)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


If you are a book purist, you might scoff when I recommend an e-reader instead of buying physical books, and I won’t blame you. The allure of the smell of pages, the weight of the book in my hands, the whole ritual, is hard to resist. 

However, if you allow me some leeway to convince you, there’s a strong argument to be made against physical books and in favor of using e-readers. So let me make the case for e-readers, because once you understand what you’ve been missing, it’s hard to go back.

Your entire library fits in your bag

This is the most obvious advantage, but it doesn’t get enough credit. I always read more than one book at a time, and carrying two or three physical books around is not realistic. Thick books alone are a chore to carry.

With an e-reader, you carry hundreds of books in a slim package. Switching between titles takes a second. If you travel frequently, this alone is reason enough to make the switch.

A thousand-page hardcover is great for your bookshelf but terrible for your commute.

Fat books are a workout, not a reading experience

If, like me, you are into fantasy books, you know they can be a behemoth to handle. You have to constantly shift how you’re holding it, find a way to keep it open, and somehow also stay comfortable. Thin books are fine, but the moment a book crosses a certain thickness, it starts working against you.

An e-reader weighs the same regardless of whether you’re reading a short novel or a massive fantasy series. That’s it. Whether I am reading The Count of Monte Cristo or the next book in Brandon Sanderson’s The Stormlight Archive series, my Supernote Nomad remains the same. 

Reading at night without waking anyone up

I do a lot of my reading at night, and this is where physical books completely fall apart for me. Lamps and book lights never feel comfortable. The light is never quite right, and if you share a room with someone, the whole setup becomes a problem.

Most e-readers, including Kindles, have a built-in backlight that you can dim to whatever level feels right. You can even switch to warm light mode, making it easier on your eyes. 

I’ve read at 3 AM with the brightness all the way down, and it felt completely natural. No lamp and no squinting required. 

Look up any word without losing your place

English is not my first language, and even for native speakers, encountering an unfamiliar word in the middle of a chapter is common. With a physical book, your options are to grab your phone and look it up, which almost always leads to distraction, or skip it and lose a bit of meaning.

On a Kindle or most other e-readers, you tap the word and the definition appears instantly. You can translate it, add it to a vocabulary list, and get back to reading in seconds. I look up far more words now than I ever did with physical books, and my reading comprehension is genuinely better for it.

Taking notes you’ll actually use later

I used to annotate physical books with a pen, and those notes would just sit there on the page, never to be seen again. Transferring them somewhere useful took more effort than I was ever willing to put in.

With my Supernote Nomad, I can use its Digest feature to clip what I am reading and quickly add any additional handwritten notes. I can then export those notes to Obsidian and process them. 

If you use any e-reader, highlighting a passage and adding a note will take a couple of seconds. Most e-readers also aggregate all your highlights and notes in one place, allowing you to quickly riffle through your notes without flipping pages. 

With physical books, my notes died on the page. With an e-reader, they became something I actually use.

Since these are digital notes, you can process them into your note-taking app to further digest the material.

Books are cheaper and easier to buy

Buying physical books is always more expensive than getting the digital version. Also, since most publishers are phasing out mass-market paperbacks, we are left with trade paperback and hardcover options, which may look better but also cost significantly more.

E-books don’t have that problem. I have purchased several books at less than half the price I would have paid for a physical version. Also, most of the time, e-books are on sale, making them even more affordable. 

And when you find a book you want to read at midnight, you don’t have to wait for a delivery or drive to a store. You buy it and start reading immediately. The convenience is hard to overstate once you get used to it.

Should you switch?

If you love the experience of physical books, the covers, the smell, the shelf aesthetic, that’s a completely valid reason to stick with them. There’s nothing wrong with it. I myself am curating my own bookshelf, and there will always be a place for those special books. 

But for convenience and ease of discovery and reading, I recommend you at least invest in one e-reader. It’s also one of the best times to buy them, as you can get good options around $100

Since these are e-readers, you don’t even need to upgrade them as often as your phone. If you don’t accidentally break them, they can easily last 5-6 years, making them worth the investment.



Source link