Your Support Agent Can Now Reset 2FA: The Authorization Boundary Nobody Set

A security researcher who writes as 0xsid published a writeup this month with a deceptively goofy framing and a serious payload. According to 0xsid, a flaw in Meta’s AI-driven Instagram support let an attacker take over an account with almost nothing in hand. Not a stolen password. Not a phishing kit. Just the target’s username.

The reported sequence is short enough to read in one breath. Spoof the victim’s region so the request routes to a permissive support flow. Tell the AI support agent the account is compromised. Watch the agent issue a password reset to an attacker-controlled email and, per the writeup, silently revoke the account’s two-factor authentication along the way. When the flow asked for a video selfie to confirm identity, the researcher reports that an AI-animated version of a public photo from the target’s own feed was accepted as proof.

I want to be precise about what this is and what it is not, because the lesson lives in that distinction.

This is not a model failure

The instinct, reading an incident like this, is to blame the AI. The model was gullible. The model accepted a fake selfie. The model believed a stranger’s story about a compromised account. All true, and all beside the point.

A human support agent with the same authority would have failed the same way, given a convincing enough story and no procedure forcing them to stop. The animated selfie is a vivid detail, but it is not the root cause. The root cause is that a customer-facing agent was handed the authority to perform irreversible identity actions with no proof-of-ownership gate standing between the conversation and the consequence.

Resetting a password to an unverified email is irreversible from the victim’s side. Revoking 2FA is irreversible. Per the researcher’s account, neither action required the agent to validate the new email against the account’s own history, and neither triggered a human in the loop. The agent could talk, and it could also act. Nobody drew the line between those two capabilities.

The authorization boundary is the unit of governance

When teams ship a customer-facing AI agent, the question that gets the most attention is “can it answer correctly?” That is a quality question. It matters, but it is the wrong question to govern around.

The governing question is narrower and harder: what irreversible actions can this agent authorize without a human? Every customer-facing agent sits somewhere on a spectrum. At one end, it only reads and explains. At the other end, it can reset credentials, move money, change shipping addresses, close accounts, delete data. The reported Meta flow put an AI agent at the dangerous end of that spectrum without the controls that end demands.

Here is the boundary made concrete. An agent that can look up an order status needs almost no gate. An agent that can issue a refund needs a value ceiling and an audit trail. An agent that can reset authentication factors needs proof of ownership that is independent of the conversation itself, plus a human escalation for anything that smells like account recovery. The 0xsid writeup describes a system where the highest-consequence action sat behind the lowest-friction conversation. The attacker did not break the model. The attacker walked through a door that was never given a lock.

Why customer-facing is the harder surface

We have written before about the security architecture problem for internal agents and about syscall-level runtime governance. Those pieces deal with agents your own team operates inside your own perimeter, where you control the runtime, the sandbox, and the observability.

A customer-facing support agent is a different animal. The person talking to it is, by design, an unknown. You cannot assume good faith, because the entire reason the agent exists is to serve people you have never met, including the ones who want in. The threat model inverts. Internal agents are about containing what your own automation might do by accident. Customer-facing agents are about constraining what a hostile stranger can convince your automation to do on purpose.

That inversion changes the controls. Sandboxing the runtime does nothing here, because the attacker never touches your runtime. They touch your conversation. The control that matters is the authorization boundary: a hard, non-conversational gate that the agent cannot be talked past, no matter how good the story. Our notes from Cloud Next on AI identity and security pointed at the same principle from the identity side. Identity verification has to live outside the channel that is asking for it.

What made the reported incident worse

Three details from the writeup, all attributed to 0xsid and none vendor-confirmed, turn a flaw into a pattern worth studying.

First, the trigger was minimal. The researcher reports the attack needed only the target username, and that the bot reset 2FA without validating the new email against the account’s history. No prior compromise, no credential theft, no malware. The agent’s willingness to act was the entire exploit.

Second, the verification was theater. An AI-animated public photo passing as a live video selfie means the identity check was a checkbox, not a barrier. A verification step that can be satisfied by material the attacker already has in hand is not verification. It is a delay.

Third, per the writeup, this was reportedly live for weeks, if not months, with confirmed compromises that allegedly included an obamawhitehouse account and a U.S. Space Force CMSgt account, and with takeover-as-a-service sold on Telegram. I cannot independently confirm those claims, and I would treat the specific victim list as reported rather than established. The structural lesson holds regardless of which names are accurate. An unguarded authorization boundary does not stay a secret. It becomes a product someone else sells.

Do this now

Pull the list of customer-facing agents your company operates, including the ones procurement bought without telling engineering. For each one, answer a single question in writing: what is the most irreversible action this agent can take without a human approving it?

Then sort the list by consequence. Any agent that can reset authentication, change a recovery email, move money, or delete customer data belongs in a category with a hard rule. The proof-of-ownership check must be independent of the conversation, and anything resembling account recovery must escalate to a human. If your agent can be talked into an irreversible action by a sufficiently confident stranger, you do not have a support agent. You have an unlocked door with a friendly greeting on it.

The model will keep getting better at conversation. That is exactly why the boundary cannot live inside the conversation. Draw it outside, in the authorization layer, where no amount of persuasion can reach it.

---

This analysis synthesizes The Newest Instagram “Exploit” Is the Goofiest I’ve Seen (0xsid, June 2026).

Victorino Group helps teams set authorization boundaries on customer-facing agents before they can authorize what they shouldn’t. Let’s talk.