The widespread hacking campaign that relied on simply asking Meta's AI chatbot to take over a victim's Instagram account appears to have continued even after the company said the issue had been resolved. While some high-profile accounts were targeted, many people complained about their accounts being hacked with uniquely named handles.

These attacks were so simple that calling them hacks may be giving the perpetrators too much credit, while also not putting enough blame on Meta for not preventing rudimentary attacks from hijacking people’s accounts. Hackers simply told the chatbot they were the owners of the target's account and asked it to link the person's account to an email they controlled. The chatbot complied, allowing the hacker to reset the target account’s password and take control.

On Monday, Meta spokesperson Andy Stone said that ‘the issue that did happen has already been fixed’. However, on Tuesday more users claimed their accounts had been hacked. Meanwhile, discussions among members of a Telegram channel suggested they were still able to exploit the chatbot for hacking purposes.

Victims reported receiving emails from Instagram warning them that their account had been compromised and asking them to reset their password. Meta announced in March that it was implementing AI to automate its support, saying the chatbot could ‘reset your password securely’. That suggests the chatbot can perform actions previously requiring human intervention.

For years, there has been a thriving market for hackers stealing OG usernames, but taking over those accounts required more complex strategies. Here, the hackers just asked and Meta’s chatbot dutifully complied. It's a stark reminder that even AI isn't infallible when it comes to security.