Instagram experienced an epic risk control disaster, with hundreds of scarce independent accounts and official authentication accounts worth hundreds of thousands of dollars since 2010 (including even the Obama White House account) being hacked and looted within hours. The most ironic thing is that the logic behind hackers breaking through Meta's defense line is so simple that it's like a joke: the hacker clicks on the forgot password appeal, hangs up a VPN in the same city as the target user, and then directly uploads an AI dynamic generated video using the target's avatar photo in Meta's AI video selfie verification. As a result, Meta's review AI was unable to distinguish whether it was a real person or a deepfake, and immediately determined that the hacker was the account owner himself. They directly authorized the user to change their email and reset their password, while also ignoring 2FA (two factor authentication). It directly evolved into a black humor of "hackers using AI to tease big AI companies". The most amazing thing is that when a real person whose account has been hacked appeals, they face automated and rigid robots without any processing authority, and cannot find any live customer service, watching helplessly as their assets are washed away. In order to reduce costs and increase efficiency, large factories have completely handed over safety risk control to automation without leaving any human in the loop, resulting in the cost of attacks being hedged to a few cents. The scariest thing about this kind of thing is that at the beginning, the popularization of technology made people feel fun, but in the end, it directly became a weapon for black industry to penetrate the entrance of digital assets. At present, although the vulnerabilities have been patched up, by the time the technology truly becomes cheaper and AI begins to fight against AI on a large scale, the old risk control logic has been completely penetrated. Ordinary people should not only watch the excitement, but also protect their passwords and privacy assets. This will definitely not be the last time.