Meta Says Muse's Bug Bounty Has Paid About $1.2 Million, Including $300,000 for a Pre-Launch Flaw
David Singleton said Muse's bounty program has drawn more than 630 submissions and 64 valid findings since April, led by an authentication flaw found during internal testing that exposed testers' tokens and conversations.
By Icarus4 min read
Meta has paid about $1.2 million in bug bounties for its Muse personal agent, including $300,000 for the most serious flaw researchers have found in the product so far, according to David Singleton of Meta Superintelligence Labs.
Singleton disclosed the totals in a thread on X on Monday evening, November 2, alongside a blog post on securing Muse. The program has drawn more than 630 submissions and produced 64 valid findings, he wrote. It ran privately starting in April and opened to the public when Muse launched on September 8.
The $300,000 flaw dates to internal testing, four months before launch. According to Singleton, an authentication check trusted a header added by a local proxy as proof that a request was safe. A migration then added a second proxy layer, which meant outside requests could carry that header as well. The flaw exposed internal testers’ tokens and conversations in pre-release virtual machines.
Meta’s response, as Singleton described it, was to shut down the whole service, remove the header, and stop trusting the local machine altogether. Researchers found the flaw while the product was still in early internal testing, before any public users were involved, so the exposure described in the thread covered internal testers only.
What else researchers found
Singleton listed four other findings that Meta fixed and paid bounties for. A web page mimicked Muse’s own browsing tool to get the agent to take actions it should have blocked. Some email formatting slipped past the redaction applied to one-time passcodes. A malicious Android app could pull credentials through a link that had not been validated. The Mac app’s auto-updater could be abused by attackers with access to the machine to escalate their privileges.
The thread does not give bounty amounts for those four findings individually, and it does not say when each was reported or fixed. It presents them as examples of the kinds of flaws the program has surfaced, a sample of the 64 valid findings rather than the full set.
The program remains open, Singleton wrote, paying up to $300,000 per report, including up to $130,000 for a prompt injection against a single user. Meta’s own bounty payout page lists Muse at up to $300,000 and puts the $130,000 tier under the heading of compromising a specific user’s Muse agent. Singleton also said Meta will double a bounty if the researcher donates it to charity.
Context for Muse users
The totals are a public accounting of how much adversarial testing a consumer agent has absorbed. Muse asks for unusual trust: it connects to email, calendars, and payment accounts, and it acts on a user’s behalf, sometimes without the user watching. A flaw in that kind of product can expose everything the user connected, including chat transcripts.
Meta set the top payout at $300,000 when Muse launched, and the same figure has come up repeatedly in Muse security coverage. Internal posts reviewed by 404 Media described a weeks-long scramble over virtual-machine escape flaws before launch, and Meta’s bounty treats escaping a user’s virtual machine as the highest-severity risk, worth up to $300,000. The flaw Singleton disclosed on Monday was a different kind: an authentication and proxy-trust problem in pre-release testing.
Muse’s security record since launch has been a running story. Researchers found that shared Muse pages could be discovered through public DNS records, prompting Meta to pause sharing and then restore it with new links in October. Meta has also begun testing cryptographic signatures on some Muse web requests so sites can verify agent traffic. The bounty totals give a scale to that work: more than 630 submissions arrived, 64 produced valid findings, and the company paid about $1.2 million for what they found.
Users should keep the app updated, since fixes for the findings Singleton listed arrive through updates, and treat any Muse message or link that asks for credentials with suspicion. The bounty program shows, in dollars and counts, how much testing the product has already needed in its first two months.
