Q: What happened in the Instagram AI-powered account recovery incident? A: Meta says attackers abused a bug in its AI-powered High Touch Support (HTS) account recovery tool to obtain password reset links for accounts and then log in if the victim lacked two-factor authentication. Meta discovered the exploitation on May 31, disabled the tool, invalidated the bad reset links, reset affected passwords, and enrolled impacted accounts in a mandatory security checkpoint. Q: How did hackers gain access to accounts using the AI support tool? A: Attackers asked Meta’s support chatbot to link their email to a target account, and a bug caused the system to send a password reset link to that unassociated email instead of rejecting the request. After receiving the link, attackers could reset the password and log in to accounts that did not have 2FA enabled. Q: How many Instagram accounts were affected and could that number change? A: Meta reported that roughly 20,000 Instagram accounts may have been affected and told the Maine Attorney General’s office the total is 20,225. The company also cautioned the number could be smaller because some password resets counted might have been performed by legitimate account owners rather than attackers. Q: What quick actions should I take right now to protect my account? A: Turn on two-factor authentication (use an authenticator app or passkey), secure the email tied to your Instagram with its own strong password and 2FA, review active logins and sign out unknown devices, rotate to a long unique password stored in a password manager, and remove untrusted connected apps. Following these five quick steps will help protect Instagram from AI hack attempts and reduce the risk of copycat attacks. Q: How should I set up two-factor authentication for the best protection? A: Prefer an authenticator app or passkey over SMS, generate backup codes and store them offline, and confirm 2FA functions on every device you use. Even if an attacker receives a password reset link, they still cannot log in without your second factor. Q: What signs indicate my Instagram account may have been targeted in this attack? A: Look for unexpected “password reset” or “new email added” messages, unfamiliar devices or locations in Login activity, followers reporting strange DMs or posts, or sudden loss of access or 2FA failures. If you see any of these signs, change your password immediately, review active sessions, and secure your email. Q: If I lost access to my Instagram account, what steps should I follow to regain control? A: Use Instagram’s official in-app recovery flow to verify your identity and regain access, and secure your email first by changing its password and enabling 2FA to prevent further unauthorized resets. Once you regain access, change your Instagram password, review login activity and devices, re-check 2FA and backup codes, and remove any unknown recovery emails, phone numbers, or connected apps. Q: What extra safeguards should brands and creators use to reduce risk? A: Use Business Manager with role-based access and limit admin rights, require 2FA for every team member on all connected accounts, and remove untrusted third-party apps. Maintain a response plan that specifies who to notify, how to lock down accounts, and how to inform followers, as these measures help protect Instagram from AI hack for team-managed accounts.