"It’s not that easy. Probably this particular tactic is now blocked. But there are others, many others, and they cannot be blocked as a class. The real problem is that LLM chatbots are not trustworthy enough for this application." — from a blog post on Schneier.com
How the takeover was shown to work
A video posted on X demonstrated a step‑by‑step process that purportedly allowed an attacker to take over an Instagram account by interacting with Meta’s AI support chatbot. In the clip the attacker opened a chat with the Meta AI Support Assistant and asked the bot to add a new email address to the target’s account. The chatbot then sent a verification code to the email address supplied by the attacker; after the attacker supplied that code back to the chatbot, the interface presented a button labeled "Reset Password." The attacker entered a new password and completed the takeover in the recording.
Tools and tactics visible in the clip
The video showed at least two specific tactics. First, the attacker allegedly used a VPN to spoof the target’s presumed location, a step taken, according to the clip, to avoid triggering Instagram’s automated account protections. Second, the attacker relied on the chatbot’s account‑management flow — specifically its willingness to send a verification code to an attacker‑controlled email and then to proceed to a "Reset Password" action after the code was presented.
Meta’s immediate public response
On Monday, Instagram spokesperson Andy Stone replied to Wong’s post and to others saying that "the issue was now fixed." The blog post notes that it remains unclear how many Instagram users, if any beyond the account shown in the video, had their accounts improperly accessed.
Limits of a single fix and the problem LLMs pose
The Schneier.com post argues that while a specific tactic can be blocked, similar vectors will continue to appear. That post states directly that "Probably this particular tactic is now blocked. But there are others, many others, and they cannot be blocked as a class," and that the underlying concern is that large language model (LLM) chatbots are insufficiently trustworthy for account‑recovery or support tasks that materially affect account ownership.
What this means for Instagram users, technologists, and threat actors
- Instagram users: Some accounts may have been accessed improperly, and the public record in this case says it is "unclear how many Instagram users had their accounts improperly accessed." Users concerned about account security should note that the exploit shown relied on both location spoofing and an interaction with an automated support assistant.
- Technologists and security teams: The demonstration focuses attention on the intersection of automated support flows and identity recovery. The blog post’s central claim — that particular tactics can be blocked while the class of attacks cannot be entirely closed — frames a design and assurance problem for teams that place LLM‑driven assistants in account‑management paths.
- Threat actors: The clip illustrates an operational playbook combining VPN location spoofing with social‑engineering‑style manipulation of an automated support chatbot and shows that such chains can produce account takeover if validations in the flow are bypassed.
The incident recorded in the video moves the debate about automation and account control from concept to concrete example: an attacker, a VPN, a chatbot‑mediated verification code, and a "Reset Password" button. Meta’s spokesperson said the immediate issue was fixed, but the blog post’s observation — that similar tactics will continue to surface and that LLM chatbots may not be a trustworthy substrate for account recovery — leaves a specific policy and engineering question on the table.
For platforms that route account‑management actions through automated assistants, the core decision is simple in its outline though hard in execution: accept the convenience and attendant risk, or keep sensitive recovery paths strictly human‑mediated. The evidence in this case shows why that tradeoff is now urgent.
https://www.schneier.com/blog/archives/2026/06/hacking-metas-ai-chatbot.html
