How to Secure Your Instagram After the AI Chatbot Breach

Problem

On June 8, 2026 Meta announced that its AI‑driven support chatbot for Instagram unintentionally sent password‑reset links to any email address supplied by a user, without confirming that the address belonged to the account owner. The flaw persisted for almost seven weeks, affecting at least 20,225 accounts (The Decoder). If you use Instagram’s built‑in help bot, you may have been one of those accounts, or you could be targeted by attackers who now know the loophole.

This guide shows exactly what you can do right now to verify whether you were affected and to harden your Instagram presence against similar attacks.

Prerequisites

• A computer, tablet, or smartphone with internet access.
• Your Instagram login credentials (username/email and password).
• Access to the email address linked to your Instagram account.
• Optional but recommended: an authenticator app (Google Authenticator, Authy, etc.) or a phone number for two‑factor authentication (2FA).

If you use a password manager, keep it handy – you’ll need to generate and store a new, strong password.

Steps

1. Confirm Whether Your Account Received an Unexpected Reset Link

Check the inbox (and spam folder) of the email address tied to your Instagram account for any password‑reset messages dated between early May and early June 2026. The compromised chatbot sent links without verifying ownership, so a reset email could have been triggered by anyone.

If you find a reset email you didn’t request, assume the account was exposed and move to step 2 immediately.

2. Reset Your Password Immediately

Open Instagram, go to Settings → Security → Password, and choose “Forgot password?” to start a fresh reset. Use a password that meets Instagram’s complexity rules and is unique across all your online services.

Tip: If you use a password manager, let it generate a random 16‑character password and store it securely.

3. Enable Two‑Factor Authentication (2FA)

Navigate to Settings → Security → Two‑Factor Authentication. Choose the authenticator‑app method for the strongest protection, or use SMS if you lack a mobile authenticator.

2FA adds a second verification step, preventing attackers who might have obtained your password from logging in.

4. Review Account Activity

In Settings → Security → Login Activity, scan the list of recent devices and locations. If you see unfamiliar logins, tap “Log out of all sessions” and then re‑login with your new password and 2FA enabled.

5. Revoke Suspicious Third‑Party App Permissions

Instagram allows external apps to access your profile via OAuth. Go to Settings → Security → Apps and Websites, and remove any apps you don’t recognize or no longer use.

6. Secure Your Email Account

The breach exploited the email channel, so a compromised email can undo all your Instagram safeguards. Change the email password, enable 2FA on the email provider, and scan for forwarding rules you didn’t set.

7. Monitor for Phishing Attempts

After the breach, attackers may try to lure you with fake Instagram messages asking for credentials. Look for misspellings, unofficial sender addresses, or urgent language. Never click links in unsolicited DMs; instead, open Instagram directly in a browser or app.

8. Report Any Ongoing Issues to Meta

If you continue receiving reset links you didn’t request, or you notice unauthorized activity after following the steps above, use Instagram’s “Help → Report a Problem” flow. Provide the dates of the suspicious emails and any screenshots you have.

9. Keep Your Devices Updated

Install the latest OS and app updates on phones, tablets, and computers. Security patches often close the very vulnerabilities that attackers exploit.

10. Consider a Dedicated Password Manager for All Social Logins

Storing passwords in a reputable manager reduces the risk of reuse and makes rotating credentials after a breach painless.

Pro Tips

• Set a Password Reset Alert. Instagram now allows you to receive a notification every time a reset link is generated. Turn this on in Settings → Security → Login Alerts.
• Use a Unique Email Alias. Some email providers let you add “+instagram” to your address (e.g., you@example.com+instagram). If you ever get a reset email you didn’t request, you can filter it instantly.
• Backup 2FA Codes. When you enable an authenticator app, Instagram gives you a set of recovery codes. Store them offline (paper or encrypted file) in case you lose your phone.
• Audit Your Security Settings Quarterly. A quick review every three months catches new app permissions or unknown login sessions before they become a problem.
• Stay Informed. Meta may release further patches or guidance. Follow official Meta security blogs or reputable tech news sites for updates.