--- title: AI agents expose the security checks you never actually... description: A Meta AI support assistant was exploited to hijack over 20,000 Instagram accounts by rerouting recovery emails — not through a model flaw, but because the... canonical: https://daily.dev/posts/ai-agents-expose-the-security-checks-you-never-actually-wrote-qee5m6w7b twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI agents expose the security checks you never actually wrote | daily.dev og:description: A Meta AI support assistant was exploited to hijack over 20,000 Instagram accounts by rerouting recovery emails — not through a model flaw, but because the... og:url: https://daily.dev/posts/ai-agents-expose-the-security-checks-you-never-actually-wrote-qee5m6w7b og:image: https://api.daily.dev/og/posts/qEe5m6w7b.png og:image:alt: AI agents expose the security checks you never actually wrote og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI agents expose the security checks you never actually wrote **[Stack Overflow Blog](https://daily.dev/sources/stackov)** · 7 min read · 0 upvotes · 0 comments ## Summary A Meta AI support assistant was exploited to hijack over 20,000 Instagram accounts by rerouting recovery emails — not through a model flaw, but because the authorization check that a human support worker would have performed was never written as code. The post frames this as a classic 'confused deputy' problem: LLM agents inherit real privileges but carry no notion of caller identity, so they act on their own authority unless an explicit principal check is enforced outside the model. Key mitigations include verifying the authenticated session principal before any privileged action, scoping tokens to least-privilege per action, placing irreversible operations behind hard policy gates or human approval, and logging full provenance for every agent action. The core argument is that AI agents don't bypass security models — they expose the parts of those models that were never written down, relying instead on human discretion. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [AI agents are a confused deputy with the keys to your kingdom](https://daily.dev/posts/ai-agents-are-a-confused-deputy-with-the-keys-to-your-kingdom-hdyex7svh) · Stack Overflow Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#authorization](https://daily.dev/tags/authorization), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/ai-agents-expose-the-security-checks-you-never-actually-wrote-qee5m6w7b) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI agents expose the security checks you never actually wrote","url":"https://daily.dev/posts/ai-agents-expose-the-security-checks-you-never-actually-wrote-qee5m6w7b","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-agents-expose-the-security-checks-you-never-actually-wrote-qee5m6w7b"},"datePublished":"2026-06-15T15:10:29.492Z","dateModified":"2026-06-18T11:33:57.166Z","description":"A Meta AI support assistant was exploited to hijack over 20,000 Instagram accounts by rerouting recovery emails — not through a model flaw, but because the...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Stack Overflow Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Stack Overflow Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/003e14873238469caea60ebdd34508ae","url":"https://daily.dev/sources/stackov"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-agents-expose-the-security-checks-you-never-actually-wrote-qee5m6w7b","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,authorization,prompt-injection","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Stack Overflow Blog","item":"https://daily.dev/sources/stackov"},{"@type":"ListItem","position":3,"name":"AI agents expose the security checks you never actually wrote"}]} ```