Hackers were targeting high-profile accounts by tricking AI into sharing reset codes without validation.