Meta's Muse AI agent bug bounty payouts reach $1.2 million
TL;DR
Meta has paid roughly $1.2 million in bug bounties for 64 valid reports on its Muse AI agent. The program ran privately from April and opened publicly at Muse's September 8 launch. The highlighted payouts covered several notable flaws, including a $300,000 authentication bypass in pre-release VMs and a prompt injection attack. Meta says it fixed the issues itself, and no user action is mentioned.
What happened
Meta disclosed that its Muse AI agent bug bounty program has awarded roughly $1.2 million across 64 valid reports. The program ran privately from April and went public at the September 8 launch. The largest payout, $300,000, was paid four months before launch for a flaw in pre-release virtual machines where an authentication check trusted a header added by a local HTTPS proxy. After a system migration added a second proxy layer, outside requests could carry that header, exposing conversations and tokens used by Meta staff. Meta took the service offline, fixed the bug and removed all trust in the local machine.
Other findings included a $90,000 reward for a prompt injection attack where a malicious webpage mimicked Muse's browsing tool status messages and got the agent to take actions it should have blocked. Meta added detection signals and changed how Muse handles suspicious tool output. Another $90,000 bounty covered email formatting that let one-time passcodes slip past Muse's redaction filters, and Meta improved its redaction logic. A $50,000 bounty covered an Android link handler that loaded a shared-page path without validating the host, so an attacker's page could obtain the privileged web view's credentials. A $1,000 bounty addressed a Mac app flaw where a local attacker could abuse automatic updates to run code with the app's privileges. Meta says it has fixed both app bugs.
Why it matters
Several findings target risks specific to AI agents, such as prompt injection and the way an agent handles tool output. A webpage that tricks an agent by mimicking system status messages is a risk for any tool that acts on a user's behalf. The Android and Mac bugs show that traditional flaws like missing host validation and weak update mechanisms still matter.
Who is affected
- Meta staff using internal pre-release Muse VMs (fixed before launch)
- Muse users whose agent browses the web or reads email (fixed by Meta)
- Muse Android and Mac app users (fixed by Meta)
What to do now
- Meta says it has fixed the reported issues, and neither source asks Muse users to take action.
- The Mac app updates automatically. Keeping the Android app current is a sensible precaution, though no fixed version is named.
- If you run AI agents that browse the web, watch for pages or tool output that mimic the agent's own tool status messages.
What we don't know yet
- Whether CVE IDs will be assigned.
- Which Android and Mac app versions carry the fixes.
- How many users the Android or Mac app bugs affected.
Sources
