20,000 Lambs Shorn By The AI Shepherd: Meta's Support Bot Becomes The Wolf
I want you to sit with this for a moment.
Twenty thousand, two hundred and twenty-five Instagram accounts. Gone. Not because of some sophisticated, nation-state operation requiring years of tradecraft. Not because someone cracked a cipher. Because Meta decided to let an artificial intelligence handle account recovery, and the wolves simply walked up and asked it nicely.
This is what happens when the Shepherds outsource their thinking to a machine.
Here is what we know. Attackers apparently manipulated Meta's AI-powered support system into performing password resets on accounts belonging to the flock. The AI, bless its silicon heart, complied. Twenty thousand lambs woke up one morning to find someone else standing in their pasture.
In the Old Days, account recovery meant a human being, a paper trail, and at minimum three forms of identification that could be physically verified. Yes, it was slow. Yes, the flock complained. That was the point. Friction is a feature, not a bug. My university colleagues called it "inconvenience." I called it "not handing the keys to a coyote in a lab coat."
Now we have AI support agents operating as the Electric Fence, and apparently the fence has a very polite "please hold, I can help you with that" setting that also opens the gate.
I am not surprised. I have been watching Meta treat security like a suggestion since before half their engineers were born. The Sky Pasture was always going to be a problem. You put your accounts up there, you accept that someone else controls the weather.
The flock, of course, had no idea any of this was happening. They never do.
Remediation
Listen carefully, because I will not repeat myself.
Enable two-factor authentication. Not the SMS kind. A proper authenticator application. SMS is a postcard. Everyone can read a postcard.
Audit your recovery options. If your account recovery path runs through an AI chatbot, you have already lost. Find out where the doors are before someone else does.
Use a passphrase, not a password. Something long. Something a machine cannot guess in an afternoon. Write it on paper and lock the paper in a drawer. Yes, a physical drawer. The kind wolves cannot access remotely.
Do not trust any support channel you did not initiate. Fake grain is still fake grain, regardless of whether it was scattered by a human or a language model.
Pressure your Shepherds. If your organization uses Meta's platform for anything business-critical, have a very uncomfortable conversation about that today.
The AI did not fail. The people who deployed it without adequate guardrails failed. As usual.
Back in my day, the fence was electric and the gatekeeper had a pulse.
Original Report: https://www.bleepingcomputer.com/news/security/meta-ai-support-data-breach-affects-20-000-instagram-accounts/