Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million

What it is

Meta's Muse is a personal AI agent that acts across a user's email, calendar and messaging, with one VM per user. David Singleton's post describes the bounty findings. The program ran privately from April and went public at the September 8 launch. Meta says it paid about $1.2 million, and 64 of 630+ reports were valid. The summary lists the findings. This document adds the mechanisms and Meta's fixes.

How it works

• $300,000 auth bypass. An authentication check treated a header added by a local HTTPS proxy as proof of a trusted source. A system migration then added a second proxy layer, so outside requests could carry the same header. The researcher showed access to conversations and tokens on pre-release VMs that Meta staff used for testing. The report came four months before launch.
• $90,000 prompt injection. A malicious page, when Muse was asked to summarize it, mimicked status messages from the agent's browsing tool. The agent then executed actions that should have been caught.
• $90,000 OTP redaction bypass. Specific formatting let one-time passcodes slip past the email redaction filters. Meta calls it one piece of an end-to-end attack.
• $50,000 Android flaw. A malicious app could pass a link to a privileged web view. The link handler recognized a shared-page path without validating the host and loaded it, so the attacker's page could take the web view's credentials.
• $1,000 Mac updater flaw. An attacker with access to the computer could hijack auto-update and run code with the app's permissions.

What to do

Meta's own fixes show what to check in similar agent systems:

• Do not treat a proxy-set header, or the local machine, as proof of trust. Re-check this whenever a migration changes the proxy chain. Meta took the service offline, fixed it, and stopped treating the local machine as trusted.
• Treat tool output that looks suspicious as untrusted, especially text that imitates the agent's own status messages. Meta added detection signals and changed how Muse handles such output.
• Validate the host, not just the path, in link handlers that feed privileged web views.

Caveats

Meta says its classifiers now catch the prompt injection and 100 variants, but this is from its own testing. The post gives no detail on how the OTP bypass fit into the larger attack.

Bounty tiers: up to $300,000 per valid report, up to $130,000 for a prompt injection affecting a single user, and up to $250,000 for a fleetwide compromise. Meta claims these are several times the top rewards advertised by other leading AI developers.