Overview
Meta has shared the top findings from the bug bounty for Muse, its personal AI agent that acts on a user's behalf across email, calendar, messaging and other accounts, with total payouts reaching about $1.2 million, per SecurityWeek. Each user's agent runs in its own virtual machine.
Program Numbers
- Ran privately from April and went public at Muse's September 8 launch
- More than 630 reports received, 64 valid
- Rewards up to $300,000 per valid report
- Prompt injection affecting one user can earn up to $130,000; a fleetwide compromise up to $250,000
Notable Findings
| Award | Finding |
|---|---|
| $300,000 | A pre-launch flaw exposed conversations and tokens on internal test VMs used by Meta staff. An authentication check trusted a header added by a local HTTPS proxy; after a migration added a second proxy layer, outside requests could carry the trusted header. Meta took the service offline, fixed the bug and stopped treating the local machine as trusted. |
| $90,000 | A malicious web page mimicked the agent's browsing-tool status messages when Muse was asked to summarize it, tricking the agent into actions it should have blocked. Meta added detection signals and changed how Muse handles suspicious tool output; its classifiers caught the attack and 100 variants in testing. |
| $90,000 | Specific formatting let one-time passcodes bypass Muse's email redaction filters, one part of an end-to-end attack. |
| $50,000 | An Android app flaw let a malicious app pass a link to a privileged web view, where an attacker's page could capture the view's credentials. |
| $1,000 | A Mac app flaw let a local attacker hijack the auto-update feature to run code with the app's permissions. |
Takeaways
- Trust decisions based on network position or proxy-added headers break when infrastructure changes.
- AI agents that read untrusted content need tool-output validation, since attackers can imitate the agent's own status messages.
- Redaction filters should be tested against formatting tricks, especially for one-time codes.
- Agent bounties pay for chained, end-to-end impact, so scope programs with those scenarios in mind.