Meta's Muse AI Agent Bug Bounty Pays $1.2M, Including $300K for Pre-Launch Data Exposure Flaw
Meta disclosed details of its bug bounty program for Muse, a personal AI agent that acts on users' behalf across email, calendar and messaging, revealing roughly $1.2 million paid out across 64 valid reports out of more than 630 submitted. The program ran privately from April 2026 before going public at Muse's September 8 launch. The largest reward, $300,000, went to a researcher who found an authentication flaw during pre-launch internal testing that exposed conversations and tokens on staff test virtual machines, caused by a misconfigured trusted-header check after a system migration added a second proxy layer. Other notable findings include a $90,000 prompt injection bypass via a malicious web page mimicking browsing tool status messages, a $90,000 report on formatting that evaded one-time passcode redaction filters, a $50,000 Android web view credential theft flaw, and a $1,000 macOS auto-update hijack flaw.
Entenda a falha
A vulnerabilidade
No CVEs were assigned. The story covers several flaws in Meta's Muse AI agent, reported through its bug bounty. The most severe, paid $300,000, was an authentication bypass in a pre-launch internal service: requests from outside could carry a header the service trusted, exposing conversations and tokens on staff test VMs. Others: a prompt injection via a malicious web page (about $90,000), one-time passcodes slipping past email redaction filters ($90,000), an Android flaw where a malicious app could get a privileged web view to steal credentials ($50,000), and a macOS auto-update hijack by an attacker with access to the computer, which runs code with the app's permissions ($1,000). The articles give no affected or fixed version numbers. Meta fixed them before or around launch.
Como funciona
In the pre-launch flaw, a local HTTPS proxy added a header to requests, and the authentication check took that header as proof the request came from a trusted source. After a system migration added a second proxy layer, requests from outside could also carry the header, so the check let them through to internal test VM data. In the prompt injection case, Muse is asked to summarize a web page, and the page imitates the status messages of the agent's browsing tool, so the agent runs actions that should have been caught. In the Android case, the link handler recognized a shared-page path, did not check the host, and loaded the link in a privileged web view, so an attacker's page could reach the web view's credentials.
Por que é vulnerável
The authentication bug came from a wrong trust assumption: a header set by a local proxy was treated as proof of origin, and the assumption broke when the migration added a second proxy layer. The Android bug was a missing host validation in the link handler. The prompt injection stemmed from the agent trusting tool-like output coming from untrusted page content. Meta fixed the first by taking the service offline, fixing the check and no longer treating the local machine as trusted. For prompt injection it added detection classifiers (reportedly catching the original attack and 100 variants) and changed how Muse handles suspicious tool output.
Como foi descoberta
The flaws were reported by outside researchers to Meta's Muse bug bounty, which ran privately from April 2026 and went public at the September 8 launch. Of more than 630 reports, 64 were valid, with about $1.2 million paid. The $300,000 report was made roughly four months before launch, during internal testing, when the researcher demonstrated access to conversations and tokens on pre-release VMs. Meta's David Singleton described the findings in a blog post, which SecurityWeek covered.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 06:16.
Detalhes técnicos
The pre-launch flaw treated an HTTP header injected by a local HTTPS proxy as proof of trusted origin; after a migration introduced a second proxy layer, external requests could carry that same trusted header, exposing internal test VM data. The prompt injection issue allowed a crafted web page, when summarized by Muse, to spoof the agent's browsing tool status messages and trigger unintended actions. The Android issue stemmed from a link handler that recognized a shared-page path without validating the host, letting a malicious app pass a link to a privileged web view and steal credentials.
Remediação
Meta took the affected pre-launch service offline, fixed the authentication bug, and removed trust from the local machine. For the prompt injection issue, Meta added detection classifiers that reportedly catch the original attack and 100 variants, and changed how Muse handles suspicious tool output. Meta pays up to $300,000 per valid report, with up to $130,000 for single-user prompt injection and $250,000 for fleetwide compromise findings.
Linha do tempo
-
Meta's Muse AI Agent Bug Bounty Pays $1.2M, Including $300K for Pre-Launch Data Exposure Flaw
ler a análise desta fonte ocultar
Meta disclosed details of its bug bounty program for Muse, a personal AI agent that acts on users' behalf across email, calendar and messaging, revealing roughly $1.2 million paid out across 64 valid reports out of more than 630 submitted. The program ran privately from April 2026 before going public at Muse's September 8 launch. The largest reward, $300,000, went to a researcher who found an authentication flaw during pre-launch internal testing that exposed conversations and tokens on staff test virtual machines, caused by a misconfigured trusted-header check after a system migration added a second proxy layer. Other notable findings include a $90,000 prompt injection bypass via a malicious web page mimicking browsing tool status messages, a $90,000 report on formatting that evaded one-time passcode redaction filters, a $50,000 Android web view credential theft flaw, and a $1,000 macOS auto-update hijack flaw.
Technical Details
The pre-launch flaw treated an HTTP header injected by a local HTTPS proxy as proof of trusted origin; after a migration introduced a second proxy layer, external requests could carry that same trusted header, exposing internal test VM data. The prompt injection issue allowed a crafted web page, when summarized by Muse, to spoof the agent's browsing tool status messages and trigger unintended actions. The Android issue stemmed from a link handler that recognized a shared-page path without validating the host, letting a malicious app pass a link to a privileged web view and steal credentials.
Remediation
Meta took the affected pre-launch service offline, fixed the authentication bug, and removed trust from the local machine. For the prompt injection issue, Meta added detection classifiers that reportedly catch the original attack and 100 variants, and changed how Muse handles suspicious tool output. Meta pays up to $300,000 per valid report, with up to $130,000 for single-user prompt injection and $250,000 for fleetwide compromise findings.