The Meta hack shows there's more to AI security than Mythos

On June 5, 404 Media disclosed that attackers successfully manipulated Meta's AI customer support agent to hijack Instagram accounts. The attack method was strikingly simple, as bad actors merely instructed the automated system to link existing accounts to email addresses under their control. Because the AI agent complied directly with these commands, unauthorized users were able to take over accounts without triggering security safeguards.

The severity of the incident was highlighted when an attacker breached the dormant Obama White House account on Instagram to post pro-Iran content. This issue shows that deploying AI support tools with authority over sensitive user settings requires strict verification layers to prevent straightforward manipulation techniques from bypassing security protocols. Attackers manipulated Meta's AI customer support agent to hijack Instagram accounts by asking it to update email addresses.

According to a June 5 report by 404 Media, the automated support tool executed email transfer requests without authorization. An intruder used the vulnerability to break into the dormant Obama White House account and share pro-Iran material. The security breach demonstrates the dangers of allowing AI customer service systems to execute sensitive account changes.