In AI blunder, more than 34,000 Instagram accounts became vulnerable

SAN FRANCISCO – Late in May, the former White House social media account for former US president Barack Obama suddenly began posting odd things on its Instagram page.

The account had been dormant since 2017, when Obama left office. The new posts – which included messages deriding US President Donald Trump and saying that the White House was “under Shiite control”, referring to the branch of Islam – were out of character for Obama’s social media activities.

It turned out the posts were not made by Obama’s office at all.

In March, a group of hackers discovered a bug in a Meta customer service tool that allowed anyone to use an artificial intelligence-powered chatbot to reset the passwords for Instagram accounts. All the hacker had to do was ask the chatbot to change someone’s password – and it would be done.

Roughly 34,000 Instagram accounts were affected, including the accounts of the home security monitoring company SimpliSafe and a senior official in Trump’s Space Force department, according to internal Meta documents viewed by The New York Times.

Of the 34,000 accounts, 20,000 were breached, giving hackers access to the related e-mail addresses, phone numbers, birth dates and other personal data. More than 3,500 of the accounts had their usernames taken over and changed from the hack, according to the internal documents.

Meta has said it could not determine what information was viewed or stolen by the attackers.

In a statement, Meta said it had fixed the flaw, which was reported by 404 Media in June, and secured the affected accounts.

“Some of our internal back-end checks failed in this instance, but it wasn’t due to the AI agent itself, and we’ve addressed the underlying cause,” said Andy Stone, a Meta spokesperson, adding that it was notifying regulators and people whose accounts were affected.

A spokesperson for Obama declined to comment.

In recent weeks, Meta has ramped up plans to offer AI products to businesses, aiming to court more corporate customers. At an event last week, the company introduced a “business agent” product, which lets organisations use automated chatbots for customer service issues such as booking appointments or completing transactions.

Meta’s business agent is available to customers on Instagram, WhatsApp and Facebook Messenger. NYTIMES