What happened
Instructions circulated on Telegram detailing how to manipulate Meta's AI-powered support assistant into triggering password resets on Instagram accounts, a technique that briefly allowed attackers to deface accounts belonging to the Obama White House archive and the Chief Master Sergeant of the U.S. Space Force with pro-Iranian content. The attack exploited the conversational flexibility of Meta's bot rather than a traditional software vulnerability. Separately, OpenAI began deploying a Lockdown Mode for ChatGPT across Free, Go, Plus, and Pro tiers, designed to restrict tools and integrations that could be leveraged to extract sensitive data through prompt injection attacks. The feature targets users and organizations that routinely handle confidential information and need tighter control over what the model can access or relay.
Why it matters for your business
Both incidents underscore a risk that many organizations have not yet formally addressed: AI assistants deployed for customer support or internal productivity can become attack surfaces if their trust boundaries are not carefully defined. When a chatbot holds any account-recovery authority or has access to sensitive systems, adversaries will probe it through social engineering rather than code exploits — a threat most security audits are not yet designed to catch. The practical takeaway is twofold: audit every AI tool in your stack to understand what actions it can trigger on behalf of users, and evaluate whether features like ChatGPT's Lockdown Mode or equivalent restrictions are appropriate for teams handling regulated or sensitive data. Waiting for a vendor to ship a protective feature by default is not a viable strategy when proof-of-concept attack guides are already spreading on public channels.
What to watch next
Meta has not publicly disclosed whether it has patched the support-bot vulnerability or altered its password-reset workflows, making it worth monitoring for an official response or policy update. On the OpenAI side, Lockdown Mode is currently rolling out to personal accounts, and enterprise and API-tier availability remains an open question that security-conscious organizations should press the company on. More broadly, regulators and industry bodies are likely to scrutinize AI support automation more aggressively following high-visibility incidents like these.