Meta reveals Muse AI flaws as bug bounty payouts hit $1.2m

Meta has disclosed the top Muse bug bounty findings, with total payouts reaching about $1.2 million since the private programme began in April and went public at Muse’s launch on 8 September. The highest single reward—$300,000—went to a pre-launch flaw that allowed access to conversations and tokens on internal test virtual machines used by Meta staff. Muse is a personal AI agent that operates on a user’s behalf across emails, calendars and other apps, with each user’s agent running on its own VM.

The vulnerability occurred during a system migration when an authentication check treated a header added by a local HTTPS proxy as proof of a trusted source, and a second proxy layer was introduced, meaning external requests could carry the trusted header. Meta took Muse offline, fixed the issue and stopped treating the local machine as trusted, according to David Singleton.

Other notable payouts included $90,000 for a report showing a malicious page could coax Muse into performing actions after being asked to summarise it, and another $90,000 for a finding where specific formatting allowed one-time passcodes to slip past redaction filters. A $50,000 reward went to an Android app flaw enabling a malicious app to pass a link to a privileged web view, while a $1,000 bounty covered a Mac app flaw that let an attacker with local access hijack the auto-update feature.

Meta notes it pays up to $300,000 per valid report, with prompt injection affecting a single user earning up to $130,000 and fleetwide compromises up to $250,000, claims attributed to Meta’s bug bounty payouts for Muse.