Meta’s AI-assisted High Touch Support account recovery tool failed to enforce three authentication controls present in the standard recovery flow, allowing password reset links to be issued for Instagram accounts without verifying requestor ownership of the associated email address. The tool was active from approximately April 17 through May 31, 2026, with confirmed compromise of more than 20,000 accounts. No CVE has been assigned and no patch applies; Meta decommissioned the tool.