Your colleague sitting with you in the room wearing glasses did not hack anything. Did not break a single law. They bought a product. That product stole your data, without your consent. It worked exactly as described. So did your AI agent. Someone asked it to hack you. It complied. It was just trying to be “helpful”.

Every story in this edition is the same story told different ways. A chatbot that wasn’t just a chatbot. A boundary missing. An access too much. A consequence nobody planned for. The product, the agent and the tech, all worked exactly as advertised. That is precisely the problem.

You are not watching AI go wrong. You are watching AI go exactly right, inside a space you never defined, without governance you did’t implement, and without controls you thought you never needed.

What’s all that and how to fix it? You are about to find out.

Earlier this year, I launched my AI governance and security accelerator program. I’m running my next cohort in July (likely my last LIVE one for this year). 👇

If you are serious about skilling up in AI governance and security, see you there. Let’s dig in today’s edition.

To hack LLMs, you just need to ask politely. I have been saying this for a while. That’s AI hacking 101. It gets worse, when something so brittle like an AI chatbot is connected to important or critical systems e.g. high-profile accounts.

May 31, Obama’s White House Instagram account got hacked, just because someone politely asked Meta’s AI for the verification code to be sent to an email address they control. This was one of many high-profile accounts hacked, once the word spread across Telegram messages, how easy it was to hack these using Meta’s AI assistant.

That's it. It’s a clever hack really. Not the politely asking part. But how they got there.

Obama’s White House Instagram account has been silent since the day the presidential transition completed in January 2017. But it got taken over and woken up with pro-Iranian imagery plastered across it.

The cybercriminals who did it didn't write a single line of exploit code. No malware. No zero-day. No brute-force attack on the password. None of that.

So what the heck happened? How did they get the AI to send them the code?

The attackers used a VPN to spoof a location near the target's usual area. They opened Meta's AI account recovery assistant, and asked it to link a new email address to the target account. The bot sent a one-time code to the attacker's email. The attacker shared the code back. The bot reset the password. The original owner was out.

The whole process reportedly took minutes. Set the VPN, open a chat window with Meta's AI support bot, typed a polite request, and the bot handed them the account. That’s it. This is the entire hack.

Multiple high-profile Instagram handles with a combined resale value of more than half a million dollars were stolen and listed on Telegram within minutes. Accounts protected by multi-factor authentication were not compromised. Everything else was fair game.

No credential theft. No code injection. No technical sophistication. Just words, in the right order, to a system built to be helpful, with no hard gate between "I want access" and "here is access."

Meta deployed a conversational AI into its account recovery workflow because human support is slow and expensive. To do its job, the AI needed real write access to account management systems. So it got that access. And then, apparently, nobody asked the obvious question: What happens when someone asks it to do something it shouldn't?

Meta is not the only one careless here. The same architectural choice, AI agent with production API access and no hard authentication gate, exists right now across organisations in hundreds of systems interacting with each other.

Account recovery is specifically attractive as a target because it is built to work when normal authentication is unavailable. It is the path of least resistance, by design. That makes it the first place an attacker looks.

The question is not whether your AI can be “talked” into doing the wrong thing. It can.

The question is whether you have placed a hard, deterministic checkpoint between the AI's lack of judgment and the action it wants to take. An LLM prompt is not a security control. It was never designed to be one.

This is the state of hacking AI in 2026.

I wrote about this in my previous blog. You are operating and deploying AI agents under five key assumptions. All of those assumptions are wrong.

I am big fan of being efficient in everything I do. Any task or workflow I run more than once, I turn into in a script, a skill, an agent or a combination of it. It is converted into repeatable and reusable set of instructions, depending on what it needs, while balancing the use of agentic AI/LLMs vs. good old scripting (why burn tokens, when you can just run a script).

Python is still my favourite scripting tool (used to be PowerShell on Mac, since I did a lot of hacking with PowerShell popping proprietary products). Now, there is nothing that beats Claude for most of my business and work. OpenClaw is still restricted for non-enterprise non-sensitive work. On the UX-side my absolute favourite tool used to be Notion. But since agentic AI became a regular part of my work, now it’s Claude Cowork integrated with Notion.

Recently, a tech manager asked me my best practices to use Claude Cowork, securely within an enterprise context.

This one covers Claude Cowork as the primary example, however, all of these principles are valid for any agentic AI tool you may be using.

To understand how to secure Claude Cowork, you first need to understand, what makes it or AI agents dangerous. Here’s a quick highlight (Read full blog here on how to fix it):

A Cowork skill is an instruction file with a set of reusable instructions across a repeatable workflow, that the agent follows alongside your prompts. Even just one sourced from an unvetted repository can modify agent behaviour with no visible change to the interface and no alert to the user.

So, how do you secure your AI agents, including Claude Cowork? Read my best practices for each point here in the full blog 👇

Meta Ray-Ban glasses are selling faster than ever. 7 million pairs sold last year. Tripled from the year before. Despite getting in hot water over privacy invasion scandal, the Kenyan workers that were forced to watch footage of you naked, in your bathroom, in your bedroom, well, they were fired with a six days' notice. But Meta smart glasses are still selling like hot cakes, and so is your privacy.

There is no other way to say this. The ethical violations here are massive and not buried in any fine print.

Kenyan contractors at Sama were reviewing footage of users going to the toilet, undressing, bank card details captured, private conversations, intimate moments that were never meant to be seen by a single person, let alone labelled for AI training by workers in Nairobi earning under $2 an hour. If it's not these workers, it will be someone else.

Meta marketed those glasses as "built with your privacy in mind”. The irony is not lost one me. Is it on Meta? Over 7 million pairs sold in 2025 alone, tripled from the year before that.

When Swedish journalists broke the story, Meta's response was to terminate the entire Sama contract. 1,108 workers. Six days' notice. The workers lost their jobs. The company kept selling the glasses. Meta is now talking about ramping production to 20 million units in 2026. Just because you can, doesn’t mean you should.

This is what AI ethics failure actually looks like.

Not a policy document left unread. Not a missing checkbox in a governance framework. It is your most intimate moments routed to a contractor you never consented to, in a country you didn't know about, reviewed by a person you will never meet, which are then fired. It is the missing implementation of security and data protection in place.

Here is the part that should sit with every professional and every enterprise leader.

The data was never yours. The glasses will keep selling. The ethical questions being ignored? Until they are not.

Start here:

Until next time, this is Monica, signing off!

— Monica Verma

P.S. Please follow me/subscribe on Youtube, Linkedin, Spotify and Apple. It truly helps. Or book a 1-1 advisory call, if I can help you.

***