Meta has paid around $1.2m to researchers who found flaws in Muse, its personal AI agent. The largest award, $300,000, was for a trust bug in pre-release test machines. The disclosed findings show where agentic AI breaks, and UK organisations planning their own agent rollouts should study them closely.
What happened
On 2 November 2026, David Singleton published a post on the Muse blog setting out the first results of the Muse bug bounty, alongside a thread on X. Muse is the personal AI agent Meta launched in the United States on 8 September. It can send email, book travel, shop and fill in online forms for its users. The bounty ran privately from April and opened to the public at launch.
According to the post, the programme has received more than 630 submissions. Of those, 64 were judged valid, and payouts so far total roughly $1.2m. The single largest award, $300,000, was paid four months before launch. Four other paid findings are described in some detail, from a $90,000 prompt injection down to a $1,000 privilege escalation in the macOS client. The headline figures were also reported by Runtime Wire and SecurityWeek.
Meta continues to offer up to $300,000 for valid reports. The ceiling for a prompt injection affecting a single user is $130,000. Researchers can also donate an award to charity, and Meta will match the donation.
The technical picture
The $300,000 bug is the most instructive. Internal test virtual machines, used by staff trying out pre-release Muse, relied on an authentication check that accepted a header, inserted by an on-box HTTPS proxy, as evidence the caller was internal. A later infrastructure migration put a second proxy layer in front of the first. That change meant requests arriving from outside could carry the same “trusted” header. A researcher spotted it and showed that conversations and tokens on those test machines could be reached. Meta says it shut the service down, fixed the problem and then went further, removing all implicit trust in the local machine.
The other disclosed findings are as follows:
- Tool-impersonating prompt injection ($90,000). A web page mimicked the status messages Muse’s own browsing tool produces. When a user asked Muse to summarise the page, the agent carried out actions it should have refused. Meta changed how Muse treats suspicious tool output and added detection signals. It says its classifiers now catch the original attack and 100 variants.
- One-time passcode redaction bypass ($90,000). Muse strips one-time passcodes out of emails so the agent never handles them. Certain formatting slipped past that filter, and Meta describes it as one part of a wider end-to-end attack.
- Android link handling ($50,000). A malicious app could hand a crafted link to a privileged web view inside the Muse app. The handler recognised a shared-page path but did not check the host, so an attacker’s page loaded with the web view’s credentials.
- macOS auto-update ($1,000). Someone who already had access to the machine could abuse the updater to run code with the app’s privileges.
Why it matters for UK organisations
Muse is not yet available in the UK, and Meta has not given a UK launch date. That does not make this a purely American story. UK firms are already connecting AI agents to mailboxes, CRMs, finance systems and browsers, either through vendor products or their own builds. The failure modes Meta has paid for are generic to that architecture: implicit trust between components, prompt injection that borrows the agent’s own voice, leaky redaction and weak validation at the mobile edge.
The prices matter too. Each payout is a market signal of how seriously one of the largest platform operators rates a class of bug. Meta offers up to $130,000 for a single-user prompt injection, so it plainly treats injection as a route to account compromise rather than a content-moderation curiosity. Muse has already had a public security wobble: secnews.co.uk has previously reported that Meta paused chat sharing after researchers found thousands of exposed links. For UK boards approving agent pilots, that combination should end the habit of treating prompt injection as a theoretical risk on a slide.
There is also a talent point. Programmes paying at this level pull the strongest hunters, including UK-based ones, towards a handful of AI platforms. Organisations running modest vulnerability disclosure programmes, or none at all, will find it harder to attract attention to their own agent deployments.
Expert view
The $300,000 finding is not really an AI bug at all, and that is exactly why I find it useful. Trusting a header because “only our proxy sets it” is a mistake I have seen on infrastructure tests for two decades. It tends to survive until someone adds a load balancer, a CDN or a second proxy and nobody revisits the assumption. Agentic products are being built at speed on top of ordinary cloud plumbing, and the old lessons on trust boundaries apply in full.
The prompt injection finding is more novel. The attacker did not ask the model to misbehave. They imitated the agent’s own tooling so that malicious content looked like system output. When we assess agent integrations, the most productive question is usually where the model decides what counts as an instruction. Anything that renders untrusted text in a format resembling internal messages is a candidate weakness.
Meta also deserves credit for publishing root causes, fixes and amounts, and for paying generously for a bug found before any customer was exposed. The 630-to-64 ratio hints at how much triage effort these programmes now absorb. Fewer than one in nine reports proved valid. Anyone budgeting for a bounty should plan for that noise as well as the payouts.
What to do now
- Map your trust boundaries. List every place where a service accepts a header, token or network location as proof of identity. Re-check those assumptions after any change to proxies, load balancers or ingress. This sits under the Cyber Essentials secure configuration control.
- Treat agent tool output as untrusted input. Ask vendors, or your own developers, how the agent distinguishes genuine tool messages from content that only looks like them, and how that is tested.
- Test redaction and filtering adversarially. If an agent is meant never to see passcodes, card numbers or secrets, include formatting and encoding variations in testing. Do not rely on happy-path checks.
- Review mobile deep links and web views. Validate hosts as well as paths, and scope any credentials a web view holds to the minimum needed.
- Apply least privilege to agents. Give agents read-only access where possible, require human approval for payments and outbound email, and keep audit trails. This maps to the user access control in Cyber Essentials.
- Put a disclosure route in place. At minimum, publish a security.txt file and a vulnerability disclosure policy in line with NCSC guidance. Consider a scoped bounty for AI features once triage capacity exists.
Bottom line
Meta’s Muse figures are the clearest public price list yet for agentic AI flaws. The most expensive bug turned out to be an old-fashioned trust boundary failure, and the most novel was prompt injection that impersonated the agent itself. UK organisations deploying agents should test for both before attackers do.
Sources
- Muse (Meta): Securing Muse: More Than $1 Million in Bug Bounties Paid Out
- Runtime Wire: Meta’s Muse has paid $1.2M in bug bounties after a $300K pre-launch flaw
- SecurityWeek: Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million
- GadgetScout: Meta Launches Muse, an AI Agent That Can Act for You
