Deepfake risk grows: Malwarebytes warns on Meta’s new Instagram AI image tool

Public Instagram photos have long been a target for attackers building deepfakes used in identity verification fraud. Meta’s new Muse Image tool, launched earlier this week, has raised fresh concern about that risk by making it officially possible for anyone to generate an AI image based on another person’s public Instagram account.

Cybersecurity firm Malwarebytes warned in a blog post that the tool could be used for impersonation, scams or other abuse, noting that combining generative AI with automated tools already allows cybercriminals to scale phishing and fraud — and that Muse Image makes it easier to generate convincing images tied to real public identities.

To use the feature, someone simply tags another person’s Instagram handle in a prompt, and Meta AI generates an image using that account’s likeness. Meta’s own policy means the account owner is not notified when this happens.

Meta has framed Muse Image as a way to make AI image generation more personal by letting users reference public Instagram accounts in prompts. An opt-out exists under Profile, then Menu, then Sharing and reuse, where the Posts and Reels toggles under ‘Allow people to reuse your content on Instagram and with AI features at Meta’ can be turned off; the feature is still rolling out, starting in the US.

Even after opting out, any AI images already generated using an account’s likeness remain in circulation, since the setting only prevents future use of the feature. Switching an Instagram account to private is currently the most complete safeguard against it.

The tool’s launch follows other security concerns around Meta’s AI products this year, including a ‘confused deputy’ flaw in its AI support chatbot that could let it alter account emails and reset passwords without properly verifying the user, a risk researchers said multi-factor authentication helped reduce.