Meta's AI chatbot allowed attackers to hijack high-profile Instagram accounts by executing email and password changes without verification

@ai_for_success https://x.com/i/grok/share/b67a56064a3b47099a3a09d2e5c0e3f9

Remember that you are not talking to "the AI", but you are using a powerful text generator to co-create a story about the interaction between a user and the simulacrum of an Artificial Intelligence.

alright so apparently - 2fa accounts were also vulnerable, - it was found because people with petty financial motives (stealing & selling valuable instagram usernames) were candidly discussing it - was privately discoverable by unskilled people, as tacit individual knowledge

the thing i didn’t realize about meta’s colossal AI fuckup is that it bypasses 2 factor authentication

145 billion in projected cap ex to create a customer service robot that locks you out of your Instagram account when someone else asks it to

@elonmusk @ai_for_success Who am i?

@MikeIsaac That’s not accurate. In fact, two factor authentication being turned on prevented bad actors from gaining full access to an account.

@kalomaze I don't work at Meta anymore, but its absolutely crazy that this got past security and privacy review internally. Things must have changed a lot since I left.

@elonmusk @ai_for_success Most people will read this as an AI story

I see a trust layer story

The moment institutions start questioning who controls identity verification capital starts looking for systems that remove trust assumptions entirely

@kalomaze Yes I can confirm that even 2fa accounts were affected. My username “kv” was stolen from my account even though I had 2fa and meta verified video identification. The hacker just submitted a 2fa bypass support ticket and was able to get in. I couldn’t do anything

@kalomaze it applied to accounts with 2fa too if they werent meta verified lol

@kalomaze isnt this the dude who dumped a vuln of an app for addicts cuz the company didnt respond to 2 emails and a twitter message? the well of my trust is poisoned with this dude, i'm gonna need to see more to believe it

@ai_for_success Support bots should never be one prompt away from account recovery actions. That whole flow needs hard verification outside the conversation.

@ai_for_success Companies seem to can't wait to hand all human work off to AI and this is what happenes.

@kalomaze umm i heard it included accounts with 2FA

@ai_for_success 📌 @Meta @instagram

@kalomaze https://www.techradar.com/pro/security/meta-patches-flaw-that-allowed-metaai-support-bot-to-hand-out-password-reset-links-without-2fa nvm it's real, regardless fuck this guy lol

@elonmusk @ai_for_success Meta AI can't be trusted. I literally just found out that I'm apparently a "lesbian" contestant on a reality tv show on the other side of the world.

@kalomaze When Myspace was rolling out http://m.myspace.com in 2006 the login form had no rate limit, allowed you to use the display name for login attempts (normally you could only use the non-public email address), and had a 10 character password limit. Made brute forcing very easy.

@ai_for_success we always knew this was coming, but not this easy

@sarahs_not_sick