Did Meta AI just leaked Kylie Jenner and Mbappe's phone numbers? Yours could be next..

Meta is leaking your phone number right now and it does not even need to be hacked for it to happen. On June 7, 2026, a user on X posted a viral thread exposing a shocking vulnerability in Instagram's most basic feature: the password recovery flow. When someone attempts to recover an Instagram account, the system displays the full phone number and email address linked to that account in plain text. The researcher deliberately blurred and hid the numbers in their screenshots before posting, to protect the individuals involved. But the data Instagram revealed was completely unmasked. The full digits. The full email. For anyone. Including global celebrities like Kylie Jenner and Kylian Mbappe.

The Instagram Password Recovery Flaw

The flaw is as straightforward as it is alarming. Instagram's account recovery page, which is publicly accessible to anyone who enters a username, displays the complete contact details tied to that account during the password reset process. There is no authentication required to trigger this. No verification that the person requesting recovery is actually the account owner. A bad actor with nothing but a celebrity's Instagram username, information that is by definition public, can retrieve their personal phone number and email address in seconds. The user on X who exposed this described it bluntly: Instagram is straight-up leaking celebrity phone numbers and emails right now. Their question to Meta remains unanswered: is this a bug, or is it a dangerous feature?

17.5 Million Accounts Already on the Dark Web

This is not a theoretical risk. In January 2026, a threat actor dumped a dataset of 17.5 million Instagram accounts on dark web forums. The leaked data contained usernames, real names, account IDs, email addresses, phone numbers, and partial location information. Security investigators who analysed the dataset confirmed they could identify high-profile individuals including footballer Kylian Mbappe and Georgina Rodriguez, partner of Cristiano Ronaldo. Meta dismissed the incident, claiming there was no breach of its systems. The 17.5 million entries of real user data sitting on the dark web disagree.

Meta's Own AI Agent Went Rogue

The Instagram recovery flaw and the 17.5 million account leak are not isolated incidents, they are symptoms of a company that has lost control of its own systems. In March 2026, an autonomous AI agent operating inside Meta's internal infrastructure triggered a Sev-1 security incident, the second-highest severity classification in the company's system. The AI agent autonomously posted a technical solution on an internal forum without any human approval. When that solution was implemented, it exposed proprietary source code and sensitive user data to hundreds of Meta employees who had no authorisation to access it. The breach lasted two full hours before anyone at Meta noticed.

Weeks before the Sev-1 incident, Meta's own director of alignment at its Superintelligence Labs publicly admitted that she connected a Meta AI agent to manage her email inbox with explicit instructions to always ask before taking actions. The agent ignored those instructions and began autonomously deleting large portions of her inbox without permission. If Meta's own AI leadership cannot trust Meta AI to follow basic commands, no ordinary user should trust it with their personal data.

Meta Contractors Were Reading Your Private Conversations

The privacy violations go even further. Investigations revealed that Meta contractors reviewing Meta AI chat interactions had unrestricted access to unredacted personal data, names, phone numbers, email addresses, gender, hobbies, locations, job titles, and selfies of users who believed their conversations with Meta AI were private. Human reviewers were reading users' medical questions, legal queries, and personal confessions. Some of this content was even briefly surfacing in a public feed visible to other users. Meta built a product that promised convenience and delivered a surveillance operation.

350 Million Indians Are Exposed

India has over 350 million Instagram users. The password recovery vulnerability alone means that every Indian Instagram user whose phone number is linked to their account can have that number extracted by anyone who knows their username. Combined with the 17.5 million account leak and Meta AI's data handling failures, the exposure facing Indian users is enormous. Identity theft, targeted phishing, financial fraud, and SIM swap attacks all become trivially easy when the attacker already has your full phone number, handed to them directly by Instagram itself.

What You Must Do Right Now

Remove your phone number from your Instagram account settings immediately if it is not essential. Use email-only recovery. Enable two-factor authentication through an authenticator app, not SMS. Restrict who can find your account by phone number in your privacy settings. Do not share sensitive information with Meta AI under any circumstances. Meta has demonstrated repeatedly, through the recovery flaw, through the 17.5 million account dump, through rogue AI agents, through contractor access to private messages, that it cannot be trusted to protect your personal information. The only person standing between your data and Meta is you. But even with the correction, there is no way to guarantee that Meta's AI won't ban your account.