The "take over any instagram/meta account through their AI password reset chatbot" was going around and sold on shady forums for ~1 month before being patched.

then server side vulnerabilities should not be reported, instead sell the data, more profitable