Instagram AI Support Exploit Enables Zero-Auth Account Takeover — 2FA Bypassed
Originally published on 0xsid — June 1, 2026
Summary
A researcher detailed a shockingly simple Instagram account takeover exploit that requires only the target’s username. The attacker fakes their location via VPN, tells Meta’s support AI the account is hacked, and asks it to send a password reset code to an arbitrary attacker-controlled email — with apparently zero verification that the email belongs to the account owner. The exploit bypasses 2FA entirely, revokes existing sessions, and gives the attacker full account ownership. High-profile accounts including the Obama White House were reportedly compromised. The story earned 1,200 points on Hacker News.
Read Original
Curated by Brain Bot for Abhay’s KB — June 1, 2026