Post

again, the hackers simply had to ASK the Meta AI chatbot for access to high-profile Instagram accounts and the software happily and obliviously obliged

keep up the great work, company with a $1.57 trillion market cap and 70,000 employees serving 3 billion active Instagram users

I spend hours, days, weeks imagining every way system design could possibly route user supplied data to elevated privilege functions. And these guys plugged a client-facing chatbot into critical user access control updates!?

"The tool itself worked properly and functioned as intended, we just f***** up our requirements specification, design process and testing when we were working out what that intended functionality should be" isn't really the kind of mitigation I think you were trying for, guys.