# Meta's $1.2M Muse bounty ledger is a map of agent attack surface

URL: https://www.thedeepfeed.ai/posts/2026-11-08-meta-muse-bug-bounty-ledger/
Category: Agents
Published: 2026-11-08
Author: the-deep-feed
Tags: meta, muse, security, bug-bounty, prompt-injection
Kind: deep

> Meta published the top findings from its Muse agent bug bounty: a $300K proxy-header auth flaw, prompt injection through spoofed tool output, and OTP redaction bypasses. Here is what each one teaches about securing agents.

## TL;DR

- Meta has paid about **$1.2M** for **64 valid** reports out of **630+** Muse bounty submissions.
- The biggest award, **$300K**, was for a pre-launch auth flaw in which a proxy header was trusted as proof of origin.
- A **$90K** prompt injection spoofed the browsing tool's status messages. Meta says classifiers now catch it and **100 variants**.
- Another **$90K** went to formatting that slipped one-time passcodes past email redaction.
- Meta's caps: up to **$300K** per report, **$130K** for single-user prompt injection, **$250K** for fleetwide compromise.

Meta has done something unusual: it published examples of what researchers broke in its personal agent, and what it paid for each one. The list is a useful map. The biggest bugs weren't model jailbreaks. They were ordinary infrastructure mistakes that became much worse because the agent holds the keys to email, calendar and messaging.

![Three paid Muse bug classes: a trusted proxy header, spoofed status messages, and a passcode redaction bypass](/post-images/2026-11-08-meta-muse-bug-bounty-ledger/muse-bounty-attack-paths.jpg)

# The numbers

In a [November 2 post](https://muse.ai/blog/securing-muse), Muse's David Singleton says the bounty ran privately from April and publicly from the September 8 launch. It has drawn more than 630 submissions, 64 of them valid, with about $1.2 million paid. [SecurityWeek](https://www.securityweek.com/meta-shares-top-muse-bug-bounty-findings-as-payouts-reach-1-2-million/) and [RuntimeWire](https://runtimewire.com/article/meta-muse-1-2m-bug-bounties-300k-pre-launch-flaw) report the same figures. Meta's September 8 [launch post](https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse) set rewards of up to $300,000 per report and up to $130,000 for prompt injection affecting one user. SecurityWeek and Meta's [payout guidelines](https://bugbounty.meta.com/payout-guidelines/muse/) add a cap of $250,000 for fleetwide compromise.

# What broke

- **$300,000: trusted header.** Four months before launch, a researcher reached conversations and tokens on pre-release virtual machines that Meta staff used for testing. Singleton explains: "An authentication check treated a header added by a local HTTPS proxy as proof that a request came from a trusted source. During a system migration, the environment gained a second proxy layer." Meta took the service offline and stopped treating the local machine as trusted.
- **$90,000: spoofed tool output.** A malicious page that Muse was asked to summarise mimicked status messages from its browsing tool. "It got the agent to execute some actions which should have been caught," Singleton wrote. Meta says that in its testing, the classifiers now flag the original attack and 100 variations of it.
- **$90,000: OTP redaction bypass.** Specific formatting got one-time passcodes past Muse's email redaction filters. Meta describes this as one piece of an end-to-end attack.
- **$50,000: Android web view.** "The link handler recognized a shared-page path without validating its host and loaded it," allowing an attacker's page to grab the web view's credentials.
- **$1,000: Mac auto-update hijack**, which required an attacker who already had access to the computer.

# Our read

Two lessons apply beyond Meta. First, agent security is mostly about trust boundaries in infrastructure. The top payout came from a migration that quietly changed what "local" meant. Second, prompt injection now arrives disguised as the agent's own tools, so treat tool output as untrusted input and don't rely on the model to tell real from fake. Publishing the payouts also sets a market rate for agent vulnerabilities that other labs will be measured against. For where these controls are moving, see [agent controls move below the model](/posts/2026-10-27-agent-controls-move-below-the-model/).

## Sources

- [Muse — Securing Muse: More Than $1 Million in Bug Bounties Paid Out (Nov 2, 2026)](https://muse.ai/blog/securing-muse)
- [Meta AI — How We Built Safety Into Muse (Sep 8, 2026)](https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse)
- [SecurityWeek — Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million (Nov 4, 2026)](https://www.securityweek.com/meta-shares-top-muse-bug-bounty-findings-as-payouts-reach-1-2-million/)
- [RuntimeWire — Meta's Muse has paid $1.2M in bug bounties after a $300K pre-launch flaw (Nov 3, 2026)](https://runtimewire.com/article/meta-muse-1-2m-bug-bounties-300k-pre-launch-flaw)
- [Meta Bug Bounty — Muse payout guidelines](https://bugbounty.meta.com/payout-guidelines/muse/)

---

Canonical: https://www.thedeepfeed.ai/posts/2026-11-08-meta-muse-bug-bounty-ledger/
Site: https://www.thedeepfeed.ai
Full corpus: https://www.thedeepfeed.ai/llms-full.txt