AnalysisPublished 4 Nov 2026

Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million

Source SecurityWeek

Description

Meta's Muse AI agent underwent a private bug bounty program before its public launch, resulting in payouts totaling approximately $1.2 million. A significant $300,000 bounty was awarded for a pre-launch vulnerability in internal test virtual machines that exposed conversations and authentication tokens due to a flawed trust validation involving proxy headers. Additional vulnerabilities included malicious web page interactions, bypassing email redaction filters, Android app link handling flaws, and a Mac app auto-update code execution issue. Meta addressed these flaws by taking the service offline, fixing the bugs, and enhancing detection mechanisms.

Impact

The primary impact involved unauthorized access to sensitive internal conversations and authentication tokens on pre-release test virtual machines, potentially compromising user data and system integrity. Additional vulnerabilities could allow attackers to execute unauthorized actions via the AI agent, bypass security filters to obtain one-time passcodes, steal credentials from privileged web views on Android, and execute arbitrary code on Mac systems via the auto-update mechanism. These flaws collectively posed risks to confidentiality, integrity, and security of the Muse AI agent and its users.

Defensive guidance

Meta has addressed the critical pre-launch vulnerability by taking the Muse service offline, fixing the authentication flaw related to proxy headers, and removing implicit trust of the local machine. Detection signals and classifier improvements have been added to catch malicious tool outputs and suspicious formatting attempts. The vendor has also patched the Android and Mac app vulnerabilities. Since these fixes have been implemented and the service was taken offline to remediate the issues, no further immediate action is required by users. Users should ensure they are running updated versions of Muse and related applications once available.

References

securityweek.com/meta-shares-top-muse-bug-bounty-findings-as-payouts-reach-1-2-million/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Nov 2026, 08:43 UTC

Technical details

References

Community reviews