Meta says it has paid roughly $1.2 million in bug bounties for security issues found in Muse, its personal AI agent. The findings included a pre-launch vulnerability that exposed conversations and authentication tokens on internal test systems, as well as flaws involving web content, email redaction and mobile application handling.
Muse is designed to act on a user’s behalf across services such as email, calendars and messaging. Meta said each user’s agent runs in its own virtual machine, making the security of the surrounding workload and its access to connected accounts central to the product’s protection.
According to Meta’s David Singleton, the company operated a private bounty program beginning in April and opened it publicly when Muse launched on September 8. The program received more than 630 reports, of which 64 were considered valid. Meta offers up to $300,000 for a valid report.
Proxy migration exposed internal test systems
The largest reported payout, $300,000, went to a researcher who identified a flaw during Muse’s early internal testing, four months before launch. The researcher demonstrated access to conversations and tokens on pre-release virtual machines used by Meta staff.
Singleton said an authentication check treated a header inserted by a local HTTPS proxy as evidence that a request came from a trusted source. A system migration added a second proxy layer, however, allowing requests from outside the environment to carry the same header. The trust check therefore did not reliably establish that a request originated from a trusted local component.
Meta took the service offline while it fixed the issue and changed the system so that the local machine was no longer treated as trusted. The episode illustrates how changes in the network path between an agent and its services can undermine assumptions built into authentication controls. For systems handling user conversations and account tokens, validating the request’s actual origin is especially important.
Agent behavior and connected apps also in scope
Two separate reports earned $90,000 each. In one, a malicious web page presented content that mimicked status messages from Muse’s browsing tool when the agent was asked to summarize the page. Meta said the content persuaded the agent to execute actions that should have been blocked. The company added detection signals and changed how Muse handles suspicious-looking tool output. Meta reported that its classifiers caught the attack and 100 variants in testing.
The other $90,000 award concerned email redaction. A researcher found that specific formatting could cause one-time passcodes to evade Muse’s filters. Meta characterized the issue as part of an end-to-end attack, rather than describing it as a standalone route to compromise. The finding highlights the challenge of reliably detecting sensitive information when content can arrive in different formats.
An Android application flaw earned $50,000. A malicious app could pass a link to a privileged web view, whose handler recognized a shared-page path but did not validate the link’s host. It then loaded the page, allowing an attacker-controlled site to obtain the web view’s credentials, Singleton said.
Meta also paid $1,000 for a Mac application issue that could let an attacker who already had access to the computer hijack the app’s automatic update process and execute code with the application’s permissions.
Bounty program covers prompt injection risks
Meta said prompt injection attacks affecting a single user may qualify for awards of up to $130,000, while a fleetwide compromise can earn up to $250,000. The higher maximum of $300,000 applies to valid reports under the program. These tiers put individual-user attacks and broader compromises within the scope of the company’s bounty approach, alongside conventional application and infrastructure vulnerabilities.
The disclosed cases span several trust boundaries: a proxy-to-service authentication check, web content interpreted by an agent, sensitive data filtering, and links passed between Android applications and a privileged web view. For cloud workload security teams, the cases underscore that isolating an agent in its own virtual machine is only one part of protecting it. Identity checks, tool-output handling, connected-account data and application interfaces also need to withstand hostile inputs and changes in system design.
Meta’s report describes fixes and testing for the issues it highlighted, but does not provide a broader account of Muse’s security architecture. The bounty results offer a view into the kinds of defects the company sought to uncover before and after the agent’s launch, as well as the potential cost of vulnerabilities that cross from untrusted content or components into privileged workloads.
