Meta disclosed multiple security incidents in recent regulatory filings, including a significant breach involving its artificial intelligence support chatbot that allowed hackers to compromise thousands of Instagram accounts.

According to a notice filed with the state of Maine, attackers exploited a bug in Meta's AI chatbot system to hijack 20,225 Instagram accounts. The exploit allowed hackers to gain unauthorized access to accounts without needing to bypass two-factor authentication, simply by manipulating interactions with the automated support system.

The breach demonstrates vulnerabilities in AI-powered customer service systems that companies increasingly rely on for user support. Meta attributed the security failure to a software bug rather than a sophisticated attack on its infrastructure.

Separately, Meta also announced it would pursue legal action against Israeli spyware firm NSO Group, while reporting that it had successfully prevented phishing attacks targeting its platforms. The company has previously been involved in legal disputes with NSO Group over allegations that the firm's surveillance software was used to target activists and journalists.

Meta has not disclosed the timeline of when the Instagram account compromises occurred or what specific user data may have been accessed. The company is required to report such incidents to state authorities under data breach notification laws.

The incidents highlight ongoing cybersecurity challenges facing major technology platforms as they expand their use of automated systems while defending against increasingly sophisticated threat actors.