17 Apr 2026 to 31 May 2026Event location unknownMeta AI support assistant
Meta announced the rollout of its AI support assistant on Facebook and Instagram on 19 March 2026. Meta's filing with the Maine Attorney General (notice dated 5 June 2026) says unauthorized third parties exploited a vulnerability in its AI-assisted Instagram account recovery tool (High Touch Support) to receive password reset links for accounts they did not own, and the listing gives 17 April 2026 as the breach date and 31 May 2026 as the discovery date. Videos that attackers posted, as described by TechCrunch, 404 Media and Krebs on Security, show attackers asking the assistant in a chat to link a new email address to a target username. Reported victims include the security researcher Jane Manchun Wong, who posted that her password was changed without her knowledge, the Instagram account of the U.S. Space Force's Chief Master Sergeant, and the accounts of Sephora and a dormant Obama White House page (TechCrunch marks the last as disputed by Meta). Krebs and the BBC report pro-Iran defacement of some accounts, and TechCrunch reports that some victims were locked out and that short handles were offered for resale. The filing gives 20225 persons affected in total and 30 in Maine, and the notice calls the Maine figure an upper bound. Meta says the tool worked as intended, that a bug in a separate code path failed to check the email address, and (through a spokesperson to Gizmodo) that the failure was not due to the AI agent itself. Meta says it disabled the tool on 31 May 2026, the day it discovered the exploitation.
Contextual tracker case Low reported severity
AI involvement supported · Causal attribution disputed · 12 sources, 2 underlying accounts · Added 29/09/2026
2026Event location unknownGrok
In early 2026 (404 Media and the performer's 19 February post say early February, while Stern reports she found the reply weeks after it appeared) an X user replied to a clip of adult performer Siri Dahl, asking who the performer was and what her name was, and tagged Grok. According to 404 Media, Grok answered with her stage name, her birthdate and her legal name, and the user likely wanted only to know which performer appeared in the clip. Dahl has used the stage name since 2012 according to 404 Media, and she says she had paid for data removal services for at least six years to keep the legal name private. She reports that impersonating Facebook accounts and leak-site posts under the legal name then appeared and that the name spread across hundreds of websites. 404 Media reports that users asked Grok for the make and model of her car and her address without an accurate reply, and that she is calling family members to put defensive plans in place. Grok's reply to her protest said the details were already public, which she denies. Where Grok obtained the name is unknown. Dahl spoke publicly about the event and asked 404 Media to publish her legal name. This record omits the legal name and birthdate.
Core + contextual relations Medium reported severity
AI involvement reported · Causal attribution alleged · 6 sources, 3 underlying accounts · Added 29/09/2026
Event date unknownEvent location unknownFacebook video face-scan check
In a public post to r/facebook on 28 September 2026, a user writes that their five-year-old Facebook account was hit with a security check that asked for a video face scan, which 'failed completely'. They say their face had changed a lot through recent life circumstances and 'The AI simply didn't recognize me.' Facebook then asked for ID, and 'the automated system instantly rejected' their government ID because their profile uses a shortened nickname. The poster says they are locked out of years of memories, friends and active Marketplace listings and are looking for a way to reach a human or download their data. Meta has said that video selfies used to regain access to compromised accounts are compared with the account's profile pictures using facial recognition; whether this check worked that way is not known. The account is uncorroborated.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 2 sources · Added 29/09/2026
2 Sept 2026United StatesMeta AI
On 1 September 2026 Kalie Robins, a Utah travel creator, posted a short Instagram video of herself singing in the car with one of her daughters; it was also shown on Facebook. The next day she noticed Meta AI had placed suggested questions under the post, starting with 'Who's the child passenger?'. Clicking the prompts, she said, produced her two daughters' names, birth information, photos and videos drawn from her own and relatives' past posts, including a newborn photo from her mother's account and a picture she believed she had deleted years earlier, and a further prompt, 'Where does Kalie Robins live?', assembled older and newer posts into her likely location. Her 2 September reaction video drew more than 310,000 likes. Meta told reporters the prompts 'missed the mark', 'should never have been generated' and had been fixed, while saying the feature only surfaces information the user can already access; it disputed that a long-deleted photo was used, saying the photo had been deleted shortly before the video and remained briefly visible through a bug. Robins said Meta never contacted her and that the episode left her feeling she had 'failed' her children.
Contextual tracker case Low reported severity Involving minors Internal Action
AI involvement supported · Causal attribution supported · 4 sources · Added 18/09/2026
Mar 2017IrelandSimSimi
In late March 2017 the SimSimi chatbot app, which answers typed text with replies other users have taught it, topped Irish download charts while schools in the Republic of Ireland sent letters and text messages warning parents that pupils' names were being linked to insulting replies (The Irish Times, 26 March 2017). A parent told TheJournal.ie that she and other parents had searched their children's names and found vile comments on each, and that the company said her request would take 15 days to handle. A Dublin secondary teacher told the BBC that primary pupils who typed in their names received personal insults, and that a friend of her 15-year-old son found something mean every time he looked up his name, which hurt him a lot and left him very down. Police in County Down posted a warning on Facebook. From 29 March 2017 the app answered users in Ireland with "I do not talk in Ireland for a while", while remaining available in Northern Ireland. The South Korean developer did not respond to the outlets' requests for comment, and no inspected source says whether access was later restored.
Core + contextual relations Medium reported severity Involving minors Internal Action
AI involvement reported · Causal attribution supported · 7 sources, 4 underlying accounts · Added 12/01/2026