Meta Discloses AI Agent Security Flaws and $1.2 Million Bug Bounty Payouts

Meta has paid approximately $1.2 million in bug bounty rewards for its Muse AI agent, following the discovery of several vulnerabilities during the product’s development and testing phases.

The largest single award, $300,000, was granted for a flaw identified during the early internal testing stage. The vulnerability exposed conversations and authentication tokens on pre-release virtual machines (VMs) used by Meta staff.

Meta explained that the issue arose during a system migration. An authentication check had been configured to treat a header added by a local HTTPS proxy as proof that a request originated from a trusted source. The introduction of a second proxy layer during migration allowed external requests to carry this trusted header.

The company took the service offline to fix the bug and has since stopped treating the local machine as a trusted entity.

Other identified vulnerabilities

Beyond the primary flaw, researchers identified several other security risks during the programme, which ran privately from April until the agent’s public launch on 8 September 2026.

• Indirect Prompt Injection: A $90,000 reward was paid for a report involving a malicious webpage. When Muse attempted to summarise the page, the site mimicked the agent’s browsing tool status messages, tricking the AI into executing unauthorised actions. Meta has since implemented new detection signals to identify suspicious tool outputs.
• Redaction Bypass: A $90,000 bounty was issued for a flaw where specific formatting allowed one-time passcodes (OTP) to bypass Muse’s email redaction filters.
• Android Credential Risk: A $50,000 reward addressed an Android application flaw. A malicious app could pass a link to a privileged web view, which the link handler would load without validating the host, potentially allowing an attacker to capture web view credentials.
• macOS Auto-update Hijack: A $1,000 bounty was paid for a flaw in the Mac application that could allow an attacker with local access to hijack the auto-update feature to execute code with the app’s permissions.

Muse is designed as a personal AI agent that performs tasks across a user’s email, calendar, messaging, and other accounts. Each user’s instance of the agent operates within its own virtual machine.

Meta reported receiving more than 630 reports, 64 of which were validated. The company maintains a high incentive structure for AI-specific security, offering up to $130,000 for prompt injection attacks affecting a single user and up to $250,000 for fleetwide compromises.