The original text is in EN, taken from the source site. Source ↗

Artificial Intelligence

Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million

A $300,000 award went to a pre-launch flaw that exposed conversations and tokens on internal Muse test VMs used by Meta staff.

By

Eduard Kovacs

| November 4, 2026 (4:27 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Meta has paid roughly $1.2 million in bug bounties for its Muse AI agent, including $300,000 for a pre-launch flaw that exposed data on internal test systems.

Muse is a personal AI agent that acts on a user’s behalf across their email, calendar, messaging and other accounts. Each user’s agent gets its own virtual machine.

The bug bounty program ran privately from April and went public at the agent’s September 8 launch, Meta’s David Singleton said in a blog post. Of the more than 630 reports received, 64 were valid.

The $300,000 reward was handed out four months before launch, while Muse was at an early internal testing stage. The researcher demonstrated access to conversations and tokens on pre-release VMs used by Meta staff to test the product.

“An authentication check treated a header added by a local HTTPS proxy as proof that a request came from a trusted source. During a system migration, the environment gained a second proxy layer. That meant requests from outside could carry the trusted header too,” Singleton explained.

Meta took the service offline, fixed the bug and stopped treating the local machine as trusted.

Advertisement. Scroll to continue reading.

A $90,000 bounty was paid for a report involving a malicious web page that, when Muse was asked to summarize it, mimicked status messages from the agent’s browsing tool. “It got the agent to execute some actions which should have been caught,” Singleton noted.

Meta has since added detection signals and changed how Muse treats tool output that looks suspicious. It says that, in testing, its classifiers now catch the attack and 100 variants.

Another $90,000 went to a report showing that specific formatting could slip one-time passcodes past Muse’s email redaction filters. Meta described it as one piece of an end-to-end attack.

A $50,000 reward went to an Android app flaw that let a malicious app pass a link to a privileged web view. “The link handler recognized a shared-page path without validating its host and loaded it,” Singleton wrote, allowing an attacker’s page to grab the web view’s credentials.

A $1,000 bounty covered a Mac app flaw that let an attacker with access to the computer hijack the auto-update feature to execute code with the app’s permissions.

Meta pays up to $300,000 per valid report, which it claims is several times more than the top rewards advertised by other leading AI developers. Prompt injection attacks affecting a single user can earn up to $130,000, while a fleetwide compromise can earn as much as $250,000.

Related: Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward

Related: Google Partially Reverses Chrome Bug Bounty Cuts

Related: Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Written ByEduard Kovacs

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Eduard Kovacs

  • Cybersecurity M&A Roundup: 37 Deals Announced in October 2026
  • Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk
  • Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
  • FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
  • Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
  • Syrian Hacker Gets Prison Time in US After Over a Decade on the Run
  • Drupal Commerce Core Vulnerability Exploited Against Online Stores
  • $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack

Latest News

  • Frontline Education Data Breach Impacts Over 1.3 Million
  • CrowdStrike Reportedly Paying $495 Million for AI Security Firms Fiddler, Dreadnode
  • Android’s November 2026 Updates Patch Over 200 Vulnerabilities
  • Critical Node-RED Flaw Exploited in Attacks
  • UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028
  • Google Dismantles XCPE Botnet of 1.3 Million Android Devices
  • NATO’s Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training
  • Over 100 European Stores Hit as Supermarket Fridge Attacks Return

Trending

Malicious Claude Code Extension Served in Cursor Supply Chain Attack

CrowdStrike Reportedly Paying $495 Million for AI Security Firms Fiddler, Dreadnode

Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist

enSilo Raises $23 Million in Series B Funding

Revolve Data Breach Impacts at Least 200,000 People

Over 100 European Stores Hit as Supermarket Fridge Attacks Return

Cybersecurity M&A Roundup: 37 Deals Announced in October 2026

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: Agentic Pentesting for a Stronger CTEM Program

November 4, 2026

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Passkeys Are Better Than Passwords. But They Are Not Enough.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)