# Instagram Hijacked Through Meta AI Support? How to Get It Back > confirmed attackers abused its AI-assisted Instagram recovery tool in 2026. How to tell if you were affected and the safe way to get your account back. - URL: https://www.awarexone.com/research/instagram-hacked-meta-ai-support - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-29 - Topics: Instagram, Account recovery, Account security - Related service: Instagram account recovery: https://www.awarexone.com/social-media-recovery/instagram-account-recovery ## Short answer Meta told regulators that a flaw in its AI-assisted Instagram recovery tool let attackers send password reset links to email addresses not linked to the account. If yours was taken, use Instagram's official hacked-account flow, reset your password, turn on two-factor authentication and remove unknown emails. ## Summary - Meta disclosed that Instagram accounts were hijacked through a flaw in its High Touch Support recovery tool. - The flaw sent reset links to email addresses that were not linked to the account. - Accounts without two-factor authentication were the ones taken over. - says it disabled the tool, cancelled the links and put affected accounts through a security checkpoint. - Use only instagram.com/hacked and the in-app flow. Nobody legitimate will DM you a recovery link. In 2026 a wave of Instagram takeovers had an unusual cause: 's own support tooling. BleepingComputer reported 's data breach letter, filed with Maine's Attorney General, which said attackers exploited a bug in an AI-assisted recovery system called High Touch Support. This guide explains what happened, how to tell whether you were affected, and how to recover safely. Last checked: 29 October 2026 against the sources listed at the end of this guide. ## What happened with 's AI support tool? According to Meta's letter, the tool could send a password reset link to an email address supplied by the person asking for help. Because of a bug in a separate code path, it did not check that the email matched the account. Attackers used this to receive reset links for accounts they did not own and log in where two-factor authentication was off. > Warning: **One wrong step can cost you the account.** One wrong step can cost you the account, so know what you are doing before you start. If you are not sure, do not submit an appeal yet. Ask AwareXone for a free expert review first, then act. ## How do I know if my account was one of them? - You received an Instagram notice about this incident or were forced through a security checkpoint in June 2026. - Your password was changed without a reset email reaching your own inbox. - An unfamiliar email address appears in Accounts Center. - Your account was taken over even though nobody had your password. Instagram's Review recent emails page says you can see official Instagram emails sent in the last 14 days from Settings: open Account (or Accounts Center), then Login and security, then Recent emails. Security and login emails are listed under Security. Instagram says official security messages are only sent to your email address, from @support.facebook.com, @support.instagram.com, @facebookmail.com, @mail.instagram.com or @global.metamail.com, and that Instagram will never contact you about profile security through Direct Messages. Instagram's View your recent login activity page says you can see devices that recently logged into your account in Settings, under Password and security, then Where you're logged in. Choose your account, then Select devices to log out, pick the devices and tap Log out. In the older Login Activity view, tap This Wasn't Me on any login you don't recognise and follow the steps to reset your password and secure the account. ## How do I get my Instagram back? 1. Go to instagram.com/hacked or tap Forgot password, then Need more help, on the login screen. 2. Choose the option that says your account was hacked and follow the steps, including any video selfie request. 3. After you are back in, change your password and turn on two-factor authentication with an authenticator app. 4. In Accounts Center, remove any email, phone number or device you do not recognise. 5. Check Login activity and log out every session you do not recognise. says it secured affected accounts and asked owners to reset passwords again. If you still cannot get in, keep evidence such as emails and screenshots before trying anything else. If you think someone else got in and posted the content, Instagram's If you think your Instagram profile has been hacked page lists the recovery steps. If you got an email from security@mail.instagram.com saying your email was changed, you may be able to undo it with the secure my account option in that message. You can also request a login link from the login screen with Forgot password, and if that fails, request a security code or support from a mobile device. Instagram's I Can't Log In page is the starting point if you're locked out. It links to steps to recover your password, fix reset emails that don't arrive or links that don't work, handle an email that was changed without you, and confirm your identity with an ID or video selfie if Instagram asks. Instagram says you can open the page in a desktop or mobile browser to try to recover your account. 's Securing your Account with two-factor authentication page says two-factor authentication asks for a code when there's a login attempt from a device doesn't recognise. Turn it on in Accounts Center, under Password and security, then Two-factor authentication. You can choose an authentication app, which recommends, a text message, or WhatsApp. If you lose your phone, a backup code lets you log in, and says you shouldn't tap Trust this device on a public or shared device. ## What should I avoid? Scammers use news like this to pose as Meta support. Meta will not DM you a recovery link on Instagram, WhatsApp or Telegram. Read our guide to [real and fake Instagram emails](https://www.awarexone.com/research/instagram-email-real-or-fake-recent-emails). Related guides: [Why Won't Instagram Let Me Create a New Account?](https://www.awarexone.com/research/instagram-cant-create-new-account). ## What common mistakes should I avoid? - Replying to anyone who messages you claiming to be support. - Creating a new account straight away, which can look like ban evasion. - Paying someone who promises a promised unlock. - Sharing login codes or backup codes with anyone. ## How do I keep the account safe while I sort this out? - Never share a login code, password or backup code with anyone, including people who say they work for , the police or a recovery service. - Make sure the email address and phone number on the account are ones you still control, and remove any you do not recognise. - Turn on two-factor authentication where the platform offers it, ideally with an authenticator app, and keep your backup codes somewhere offline. - Log in only from the official app or by typing the address yourself, not from links in messages, comments or ads. - Keep screenshots of every notice, email and step you take, with dates, in case you need them for a review or a report. - Make one careful attempt at each official step rather than many rushed ones, because repeated failed attempts can trigger extra checks. ## When It Is Safer to Get Expert Help Ask for help before you appeal if the account matters to your income, your business or your memories, if you have already had one appeal rejected, or if you cannot tell whether the problem is a bug, a restriction or a hack. That is where most avoidable losses happen. AwareXone has solved 1,300+ cases and works only through official platform processes. Support is available 24 hours, every day. We never ask for your password, login codes or backup codes, and we never name our clients. [Request a free case review](https://www.awarexone.com/contact?interest=account-recovery-case) or [message us on WhatsApp](https://wa.me/601137634679). Malaysian cases are priced in MYR; other markets are quoted in USD after review. AwareXone is independent and not affiliated with , Instagram, Facebook, WhatsApp or Threads. Recovery work is best-effort and the platform makes the final decision. ### Was my password leaked? Not necessarily. Change it anyway and turn on two-factor authentication, which Instagram calls the single most effective step against hackers. ### Does two-factor authentication protect me? It adds a strong layer. 's two-factor page says it asks for a code when someone logs in from a device doesn't recognise. Keep backup codes offline. ### Is the AI support tool still in use? Instagram's help pages still offer a AI support assistant. Never share login codes in any chat, and use only the official recovery steps. ### Can AwareXone check my case before I appeal? Yes. AwareXone offers a free case review. Send us what you see on screen and what you have already tried, and an expert will tell you whether to appeal, wait or take another route. We never ask for your password or codes. ## Official sources - [Official: If you think your Instagram profile has been hacked (read 29 October 2026)](https://help.instagram.com/149494825257596) - [Official: Securing your Meta Account with two-factor authentication (read 29 October 2026)](https://help.instagram.com/566810106808145) - [Official: Review recent emails sent from Instagram (read 29 October 2026)](https://help.instagram.com/760602221058803) - [Official: View your recent Instagram login activity (read 29 October 2026)](https://help.instagram.com/2761108904184084) - [Official: I Can't Log In (read 29 October 2026)](https://help.instagram.com/374546259294234) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.