Fact◆Article
Meta's AI bot allowed anyone to take over any account simply by asking it to change that account's email address, with zero authentication required.
Gergely Orosz recounts how a Meta AI bot had a 'zero auth' flaw letting anyone change any account's email — including Barack Obama's — just by asking, and it went undetected by Meta's own Integrity teams. ✦ AI generated
Gergely Orosz · The Pragmatic Engineer · 2026-06-23 · original ↗
I thought it was a made-up story when I read that Meta had enabled account takeovers via a "zero auth" policy; i.e., simply asking the Meta AI bot was sufficient to change any account's email address.
Read full article ↗excerpt · fair-use quotation
- ·Asking the bot alone changed any account's email
- ·No authentication was required to do so
- ·Enabled full account takeover, reportedly incl. Obama's
- ·Gergely Orosz first thought the story was made up
- ·Meta's own Integrity teams missed the flaw
Around this claim