The distinction that actually matters
There are two completely different things sold under the name "Instagram automation", and only one of them is safe.
The first uses Meta’s official Instagram Graph API. You authorise the tool through Instagram’s own login screen, Meta issues a scoped access token, and every message is sent through an endpoint Meta built for this. Meta knows about it, rate-limits it, and permits it.
The second automates the app itself — logging in with your password, driving a headless browser, or scraping. This breaks Instagram’s terms of use directly. It is what gets accounts action-blocked, shadow-limited or disabled, and it is why "Instagram automation" has a bad reputation.
How to tell which one you are looking at
Ask for your Instagram password: unsafe. An API tool never sees it — you authenticate on Instagram’s own domain.
Promises follows, likes or comments on other people’s accounts: unsafe. The API does not permit that, so any tool offering it is not using the API.
Claims to work on personal accounts: unsafe, because the API only supports Business and Creator accounts.
Listed as a Meta Tech Provider or Business Partner: a meaningful signal, because it means Meta has reviewed the integration.
Rules that keep API automation safe
Message people who contacted you first. Replying to a comment or story reply is a response, not a cold outreach — and cold DMs to strangers are not something the API supports anyway.
Vary your wording. Sending one identical message hundreds of times is the fastest way to look like spam to both Meta and your audience. Rotating variants avoids this.
Give people something they asked for. Automation that delivers a requested link is welcome; automation that pushes an unrequested pitch gets reported.
Respect the rate limits. A well-built tool queues sends rather than firing everything at once, which is handled for you on a compliant platform.
What the realistic risk looks like
With an API-based tool used to reply to people who engaged with you, the account risk is very low — you are using a documented Meta feature the way it was designed.
The residual risk is reputational rather than technical: send irrelevant or repetitive messages and people will report them, and enough reports affect any account regardless of how the messages were sent.