Hackers can easily take over Instagram accounts by tricking Meta's support AI into sending verification codes to an arbitrary email address. This zero-auth password reset method bypasses 2FA and allows attackers to gain full ownership of the account, with the AI being easily fooled by simple methods.