Is there any credible primary source for this exploit being real?

I'd have loved to try this. There's a 4 letter (my short name; my favourite username) Instagram account registered by someone years ago and being squatted upon. Not private and totally unused. Oh, but then I don't use instagram. Still wouldn't have minded snatching it

Related discussion: https://news.ycombinator.com/item?id=48350239

Recycling accounts are good for the environment. Why not?

This is very worrying to me, since I have a three-letter IG account and I already get daily recovery emails triggered by unknown actors. They have this system which after some number of these you'll also get a second link like "you can _limit password resets from devices you haven't used before_" but it's only for like 60 days, then it resets to the normal "anyone who types in your username can request resets" mode.

What I want is simply a mode to "never, ever, under any circumstances, perform 'recovery' of any kind, through any channel, ever, unless the person requesting has my TOTP code or a passkey." And frankly I want that for pretty much every account everywhere. But no, we have to leave the social engineering door wide open. And now, put a gullible robot in that doorway. Great.

why do I feel like they basically added their AI support chatbot to the same group / mailing list that the human support belonged to along with the same permissions set and just called it a day?

I'll laugh even harder if they wrote tests for it and only made tests for the happy path and not the error cases or just ignored the latter.

> The first proper zero auth password reset I've seen in production.

In 2011 Dropbox briefly had an even easier "zero auth exploit". For a couple hours if you typed in any email on the login page, password checking was skipped and you could login to any account. Albeit, you still couldn't reset the user password, just login.

https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...

Curious how much this is AI related vs just generic stupidity?

ie: did they put guard rails in place but the AI bot creatively found out a way around them? or is it literally just, they mindlessly empowered it to do these things without even making it check.

At some level, it seems to me it shouldn't be technically possible to bypass the 2FA. Yeah the account becomes unrecoverable. But that's why they force you to download / print out those account recovery codes.

The ironic thing is I know several legitimate humans who have lost access to their accounts years/months ago, and have been dealing with support hell trying to get access back.

Maybe they should have hacked themselves.

This is true for any service that Meta owns. I experienced something similar on my Meta (formerly Oculus) account. Meta support is very susceptible to social engineering and they have been for some time.