The newest Instagram “exploit” is the goofiest I've seen

instagram’s account recovery flow is a masterclass in what not to do. attacker spoofs location via vpn, contacts support ai claiming compromise, redirects verification codes to attacker-controlled email, done. 2fa gets nuked in the process since the system treats this as a legitimate owner reset. the goof part: ai selfie verification passes on animated public photos. this stayed live for weeks/months at scale before patching. worth reading as a cautionary tale on outsourcing security logic to systems without proper guardrails—the tradeoff of frictionless support bought at the cost of account takeover vulnerability.