Meta's Account Recovery AI Becomes Hacking Tool in 20,000+ User Breach

This incident exposes how AI systems can introduce unexpected vulnerabilities even when protecting critical functions like account recovery. Meta's chatbot failed to verify email addresses during password resets, allowing attackers to hijack 20,000+ accounts without the owners' knowledge—gaining access to personal data, direct messages, and account activity. It raises urgent questions about how thoroughly companies test AI systems in security-sensitive roles before deployment.