Muse Bug Bounty Has Paid About $1.2m, With a Top Award of $300,000

Muse, Meta’s AI agent, says its bug bounty has paid out about $1.2m to outside researchers, including a $300,000 award for a flaw found and fixed four months before the product launched.

David Singleton set out the figures in a Muse blog post, “Securing Muse”, on 2 November, and in a thread on X. The post walks through several of the bugs and, more usefully, what Muse changed in its defences as a result.

What the Muse bug bounty has paid for

The programme ran privately from April and opened to the public with Muse’s launch on 8 September. Since then, Muse says, it has received “more than 630 submissions, identified 64 valid findings” and “awarded ~$1.2 million USD”. “We’ve now paid out more than $1 million,” Singleton writes. That works out at roughly one valid finding for every ten submissions. The post does not break down what happened to the remaining submissions.

The biggest single award, $300,000, came four months before launch. The flaw gave access to conversations and tokens in pre-release virtual machines used by employees and engineers. An authentication check trusted a header added by a local HTTPS proxy, and a later migration added a second proxy layer, which broke that assumption. “We shut the service down, addressed it immediately and continued by removing all trust in the local machine,” Singleton writes.

Muse claims its top award “is several times higher than other major AI labs’ published maximums”. Meta’s payout guidelines for Muse list rewards of up to $300,000, up to $130,000 for a prompt injection affecting a single user, and double payouts when researchers donate a bounty to charity.

The defences behind the fixes

Other paid findings show where an AI agent is most exposed. A prompt injection that imitated the status messages of Muse’s browsing tool earned $90,000; Muse says its classifiers now flag the original attack and 100 variations of it. A bypass of the redaction that hides one-time passcodes also earned $90,000, as one part of a wider end-to-end attack.

Away from the model itself, an Android app link handler that did not check the host, exposing web-view credentials, earned $50,000. A privilege escalation in the Mac auto-updater earned $1,000. The spread of those amounts matters: the largest sums went to flaws that could reach user conversations, credentials or passcodes, while a local bug on one platform drew a far smaller reward. Because these fixes are described publicly, other teams can check their own products for the same weaknesses.

Why the Muse bug bounty matters for AI agents

The pattern in Muse’s list is that the costliest bugs were not exotic model failures but ordinary trust mistakes around the model: a header taken on faith, a link handler that did not check where it was going, an updater with too much power. Agents widen that surface because they hold credentials, browse and act for the user, so a classic web or app bug can expose far more than it would in a chat window.

Prompt injection is the AI-specific risk, and Muse’s answer, training classifiers on many variants of a single real attack, is a practical approach other agent builders can copy. Publishing the bugs and the changes is itself a defence, since it shows researchers what kind of report pays.

TSN has covered Muse’s security before, including claims by Claroc that Muse share links could be found through public DNS, and its launch in Japan, its first market outside North America. Rival labs are moving the same way: OpenAI’s programme has paid for flaws such as one that leaked hidden reasoning. Whether high published maximums lead to more serious reports, and fewer flaws reaching users, is the next test for Muse and for its rivals.

Sources

• Muse: Securing Muse, by David Singleton (2 November 2026)
• Meta Bug Bounty: Muse payout guidelines
• @dps on X

Related stories

• Meta Muse Share Links Can Be Found Through Public DNS, Security Firm Claroc Says
• Meta Launches Muse AI Agent in Japan, First Stop Outside North America
• OpenAI Fixes Flaw That Leaked Hidden Reasoning, Pays Xint $6,000