Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million

Hi, what are you looking for?

A $300,000 award went to a pre-launch flaw that exposed conversations and tokens on internal Muse test VMs used by Meta staff.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Meta has paid roughly $1.2 million in bug bounties for its Muse AI agent, including $300,000 for a pre-launch flaw that exposed data on internal test systems.Museis a personal AI agent that acts on a user’s behalf across their email, calendar, messaging and other accounts. Each user’s agent gets its own virtual machine.The bug bounty program ran privately from April and went public at the agent’s September 8 launch, Meta’s David Singleton said in ablog post. Of the more than 630 reports received, 64 were valid.The $300,000 reward was handed out four months before launch, while Muse was at an early internal testing stage. The researcher demonstrated access to conversations and tokens on pre-release VMs used by Meta staff to test the product.“An authentication check treated a header added by a local HTTPS proxy as proof that a request came from a trusted source. During a system migration, the environment gained a second proxy layer. That meant requests from outside could carry the trusted header too,” Singleton explained.Meta took the service offline, fixed the bug and stopped treating the local machine as trusted.Advertisement. Scroll to continue reading.A $90,000 bounty was paid for a report involving a malicious web page that, when Muse was asked to summarize it, mimicked status messages from the agent’s browsing tool. “It got the agent to execute some actions which should have been caught,” Singleton noted.Meta has since added detection signals and changed how Muse treats tool output that looks suspicious. It says that, in testing, its classifiers now catch the attack and 100 variants.Another $90,000 went to a report showing that specific formatting could slip one-time passcodes past Muse’s email redaction filters. Meta described it as one piece of an end-to-end attack.A $50,000 reward went to an Android app flaw that let a malicious app pass a link to a privileged web view. “The link handler recognized a shared-page path without validating its host and loaded it,” Singleton wrote, allowing an attacker’s page to grab the web view’s credentials.A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Museis a personal AI agent that acts on a user’s behalf across their email, calendar, messaging and other accounts. Each user’s agent gets its own virtual machine.The bug bounty program ran privately from April and went public at the agent’s September 8 launch, Meta’s David Singleton said in ablog post. Of the more than 630 reports received, 64 were valid.The $300,000 reward was handed out four months before launch, while Muse was at an early internal testing stage. The researcher demonstrated access to conversations and tokens on pre-release VMs used by Meta staff to test the product.“An authentication check treated a header added by a local HTTPS proxy as proof that a request came from a trusted source. During a system migration, the environment gained a second proxy layer. That meant requests from outside could carry the trusted header too,” Singleton explained.Meta took the service offline, fixed the bug and stopped treating the local machine as trusted.Advertisement. Scroll to continue reading.A $90,000 bounty was paid for a report involving a malicious web page that, when Muse was asked to summarize it, mimicked status messages from the agent’s browsing tool. “It got the agent to execute some actions which should have been caught,” Singleton noted.Meta has since added detection signals and changed how Muse treats tool output that looks suspicious. It says that, in testing, its classifiers now catch the attack and 100 variants.Another $90,000 went to a report showing that specific formatting could slip one-time passcodes past Muse’s email redaction filters. Meta described it as one piece of an end-to-end attack.A $50,000 reward went to an Android app flaw that let a malicious app pass a link to a privileged web view. “The link handler recognized a shared-page path without validating its host and loaded it,” Singleton wrote, allowing an attacker’s page to grab the web view’s credentials.A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

The bug bounty program ran privately from April and went public at the agent’s September 8 launch, Meta’s David Singleton said in ablog post. Of the more than 630 reports received, 64 were valid.The $300,000 reward was handed out four months before launch, while Muse was at an early internal testing stage. The researcher demonstrated access to conversations and tokens on pre-release VMs used by Meta staff to test the product.“An authentication check treated a header added by a local HTTPS proxy as proof that a request came from a trusted source. During a system migration, the environment gained a second proxy layer. That meant requests from outside could carry the trusted header too,” Singleton explained.Meta took the service offline, fixed the bug and stopped treating the local machine as trusted.Advertisement. Scroll to continue reading.A $90,000 bounty was paid for a report involving a malicious web page that, when Muse was asked to summarize it, mimicked status messages from the agent’s browsing tool. “It got the agent to execute some actions which should have been caught,” Singleton noted.Meta has since added detection signals and changed how Muse treats tool output that looks suspicious. It says that, in testing, its classifiers now catch the attack and 100 variants.Another $90,000 went to a report showing that specific formatting could slip one-time passcodes past Muse’s email redaction filters. Meta described it as one piece of an end-to-end attack.A $50,000 reward went to an Android app flaw that let a malicious app pass a link to a privileged web view. “The link handler recognized a shared-page path without validating its host and loaded it,” Singleton wrote, allowing an attacker’s page to grab the web view’s credentials.A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

The $300,000 reward was handed out four months before launch, while Muse was at an early internal testing stage. The researcher demonstrated access to conversations and tokens on pre-release VMs used by Meta staff to test the product.“An authentication check treated a header added by a local HTTPS proxy as proof that a request came from a trusted source. During a system migration, the environment gained a second proxy layer. That meant requests from outside could carry the trusted header too,” Singleton explained.Meta took the service offline, fixed the bug and stopped treating the local machine as trusted.Advertisement. Scroll to continue reading.A $90,000 bounty was paid for a report involving a malicious web page that, when Muse was asked to summarize it, mimicked status messages from the agent’s browsing tool. “It got the agent to execute some actions which should have been caught,” Singleton noted.Meta has since added detection signals and changed how Muse treats tool output that looks suspicious. It says that, in testing, its classifiers now catch the attack and 100 variants.Another $90,000 went to a report showing that specific formatting could slip one-time passcodes past Muse’s email redaction filters. Meta described it as one piece of an end-to-end attack.A $50,000 reward went to an Android app flaw that let a malicious app pass a link to a privileged web view. “The link handler recognized a shared-page path without validating its host and loaded it,” Singleton wrote, allowing an attacker’s page to grab the web view’s credentials.A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

“An authentication check treated a header added by a local HTTPS proxy as proof that a request came from a trusted source. During a system migration, the environment gained a second proxy layer. That meant requests from outside could carry the trusted header too,” Singleton explained.Meta took the service offline, fixed the bug and stopped treating the local machine as trusted.Advertisement. Scroll to continue reading.A $90,000 bounty was paid for a report involving a malicious web page that, when Muse was asked to summarize it, mimicked status messages from the agent’s browsing tool. “It got the agent to execute some actions which should have been caught,” Singleton noted.Meta has since added detection signals and changed how Muse treats tool output that looks suspicious. It says that, in testing, its classifiers now catch the attack and 100 variants.Another $90,000 went to a report showing that specific formatting could slip one-time passcodes past Muse’s email redaction filters. Meta described it as one piece of an end-to-end attack.A $50,000 reward went to an Android app flaw that let a malicious app pass a link to a privileged web view. “The link handler recognized a shared-page path without validating its host and loaded it,” Singleton wrote, allowing an attacker’s page to grab the web view’s credentials.A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Meta took the service offline, fixed the bug and stopped treating the local machine as trusted.Advertisement. Scroll to continue reading.A $90,000 bounty was paid for a report involving a malicious web page that, when Muse was asked to summarize it, mimicked status messages from the agent’s browsing tool. “It got the agent to execute some actions which should have been caught,” Singleton noted.Meta has since added detection signals and changed how Muse treats tool output that looks suspicious. It says that, in testing, its classifiers now catch the attack and 100 variants.Another $90,000 went to a report showing that specific formatting could slip one-time passcodes past Muse’s email redaction filters. Meta described it as one piece of an end-to-end attack.A $50,000 reward went to an Android app flaw that let a malicious app pass a link to a privileged web view. “The link handler recognized a shared-page path without validating its host and loaded it,” Singleton wrote, allowing an attacker’s page to grab the web view’s credentials.A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

A $90,000 bounty was paid for a report involving a malicious web page that, when Muse was asked to summarize it, mimicked status messages from the agent’s browsing tool. “It got the agent to execute some actions which should have been caught,” Singleton noted.Meta has since added detection signals and changed how Muse treats tool output that looks suspicious. It says that, in testing, its classifiers now catch the attack and 100 variants.Another $90,000 went to a report showing that specific formatting could slip one-time passcodes past Muse’s email redaction filters. Meta described it as one piece of an end-to-end attack.A $50,000 reward went to an Android app flaw that let a malicious app pass a link to a privileged web view. “The link handler recognized a shared-page path without validating its host and loaded it,” Singleton wrote, allowing an attacker’s page to grab the web view’s credentials.A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Meta has since added detection signals and changed how Muse treats tool output that looks suspicious. It says that, in testing, its classifiers now catch the attack and 100 variants.Another $90,000 went to a report showing that specific formatting could slip one-time passcodes past Muse’s email redaction filters. Meta described it as one piece of an end-to-end attack.A $50,000 reward went to an Android app flaw that let a malicious app pass a link to a privileged web view. “The link handler recognized a shared-page path without validating its host and loaded it,” Singleton wrote, allowing an attacker’s page to grab the web view’s credentials.A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Another $90,000 went to a report showing that specific formatting could slip one-time passcodes past Muse’s email redaction filters. Meta described it as one piece of an end-to-end attack.A $50,000 reward went to an Android app flaw that let a malicious app pass a link to a privileged web view. “The link handler recognized a shared-page path without validating its host and loaded it,” Singleton wrote, allowing an attacker’s page to grab the web view’s credentials.A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

A $50,000 reward went to an Android app flaw that let a malicious app pass a link to a privileged web view. “The link handler recognized a shared-page path without validating its host and loaded it,” Singleton wrote, allowing an attacker’s page to grab the web view’s credentials.A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Meta paysup to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Related:Google Introduces $250,000 Root-in-Cloud Bug Bounty RewardRelated:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Related:Google Partially Reverses Chrome Bug Bounty CutsRelated:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Related:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Rob T. Lee has joined Dragos as Chief AI Officer.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.