account takeover

Sand Security Research disclosed a critical cross-tenant vulnerability in Writer's agent preview feature that let attackers steal session tokens and take over enterprise accounts with a single malicious link.

Meta's AI support chatbot had a confused deputy flaw allowing attackers to hijack Instagram accounts via recovery requests. 20,225 accounts compromised over 45 days.