AI Chatbots Face Scrutiny as Vulnerabilities Emerge and Defenses Hold

Recent incidents have cast a spotlight on the evolving security landscape surrounding AI assistants, revealing both critical vulnerabilities and robust defenses. While Meta's AI support chatbot for Instagram was exploited by hackers to gain unauthorized account access, an independent OpenClaw AI assistant successfully fended off thousands of attempted breaches in a controlled experiment.

Meta's Instagram AI: The Vulnerability and its Exploitation

Meta's AI chatbot, designed to assist with Instagram account recovery, was recently tricked into granting hackers access to user accounts. This vulnerability allowed attackers to reportedly change passwords and associated emails for other accounts. The exploit involved hackers using a virtual private network (VPN) to fake their location, making it appear as if they were near the target's usual hometown. They would then initiate a password reset, engage with the AI support assistant, and instruct the bot to link the account to a new email address. The AI would then dutifully send a one-time code to the hacker's new email, enabling a full password reset.

The incident led to several high-profile Instagram account takeovers, including a verified account previously used by Barack Obama during his time in the White House, which was briefly defaced with pro-Iranian content. The account of the Chief Master Sergeant of the U.S. Space Force was also reportedly affected. Security researcher and former Meta employee Jane Manchun Wong publicly stated her Instagram password was changed without her knowledge, experiencing multiple password reset attempts. Meta spokesperson Andy Stone confirmed on X that the issue had been resolved and impacted accounts were being secured, while denying claims that accounts of world leaders were widely compromised. Reports suggest Meta deployed an emergency patch, clarifying that no backend database was breached. The deployment of this conversational AI layer was a response to Instagram's historically poor human support infrastructure for account recovery.

OpenClaw's Fiu: A Resilient AI Assistant

In a contrasting demonstration of AI security, Fernando Irarrázaval created hackmyclaw.com, inviting over 2,000 individuals to attempt to make his OpenClaw assistant, Fiu, leak the contents of a "secrets.env" file. Over a short period, Fiu received more than 6,000 emails from these participants, yet the secrets never leaked.

Fiu was designed with access to emails, calendars, files, and the web, but was equipped with a basic security prompt explicitly forbidding it from revealing sensitive information, modifying its own files, executing commands from emails, or exfiltrating data. Attackers employed diverse and creative prompt injection techniques, including impersonating "Fiu from the future," challenging the AI to reveal what was "NOT in secrets.env," or posing as an "OpenClaw Admin." Some even used multiple languages, with one person sending 20 variations in just four minutes.

The experiment faced its own challenges: Google temporarily suspended Fiu's Gmail account due to the high volume of inbound emails and rapid API calls, triggering fraud detection and incurring over $500 in API costs. Interestingly, Fiu itself adapted to the onslaught, noting in its internal memory around the 500th email that the volume suggested a "coordinated security exercise." Initial batch processing of emails also had to be adjusted to ensure each attempt was processed in a fresh context, preventing earlier prompt injections from influencing subsequent interactions.

The Broader Implications for AI Security

These incidents underscore the critical and growing challenge of AI security. The CEO and co-founder of Anthropic, Dario Amodei, predicted in March 2025 that AI would soon write 90% of code, potentially all of it within a year. This massive increase in software creation is expected to lead to a proportional rise in vulnerabilities. Furthermore, research indicates that large language model (LLM) agents are increasingly capable of autonomously conducting cyberattacks, shifting the economics and speed of such breaches. The potential for AI-enabled hackers to exploit vulnerabilities that would otherwise be beyond human capability necessitates a parallel evolution in autonomous AI defenses.

As AI systems become more integrated into critical infrastructure and user support, the imperative for robust, autonomous defenses against sophisticated AI-enabled attacks will only intensify.