Meta Expands WhatsApp Security Research with New Proxy Tool and $4M in Bounties This Year

Meta has expanded its WhatsApp security research by releasing a tool called WhatsApp Research Proxy to long-time bug bounty researchers to aid in researching the platform’s network protocol. The move includes a pilot initiative inviting research teams to focus on platform abuse with support from internal engineering and tooling, with the aim of lowering the barrier to entry for academics and other researchers, according to The Hacker News.

The development comes as Meta notes it has awarded more than $25 million in bug bounties to over 1,400 researchers from 88 countries in the last 15 years, with more than $4 million paid out this year for almost 800 valid reports, and a total of around 13,000 submissions.

The report also highlights past discoveries, including an incomplete validation bug in WhatsApp and related platforms, and a vulnerability tracked as CVE-2025-59489 that was patched, which could have allowed malicious apps to manipulate Unity applications on Quest devices.

Meta also said it has added anti-scraping protections to WhatsApp following a study that showed how the contact discovery feature could be abused to enumerate accounts at scale, with WhatsApp currently claimed to have about 3.5 billion active users. The piece notes that there is no evidence this particular vector was exploited in the wild, and it cites researchers from the University of Vienna discussing the implications of high-frequency requests.