Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million
Meta paid $1.2M in bug bounties for its Muse AI agent, including $300K for a pre-launch data exposure flaw.
Meta has awarded approximately $1.2 million in bug bounties for its Muse AI agent, with a significant $300,000 bounty for a pre-launch vulnerability. This flaw, discovered before Muse's public launch, exposed conversations and tokens on internal test virtual machines. The company also detailed other notable bug payouts, including rewards for issues related to malicious web page summarization, one-time passcode bypass, and an Android app vulnerability.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Meta?
Get an email when a new story names Meta, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical pre-launch vulnerability in Meta's Muse AI agent exposed internal conversations and authentication tokens on test virtual machines, earning a $300,000 bounty — one of the largest in the program's history. This incident illustrates that AI systems, even before public release, can carry severe security flaws that expose sensitive data and credentials if not rigorously tested. The additional findings around OTP bypass, malicious summarization, and mobile app vulnerabilities reveal systemic gaps across the product's attack surface. Bug bounty programs are valuable, but they should complement — not substitute — structured pre-release security testing and configuration hardening. Organizations building AI agents must treat internal test environments with the same security rigor as production systems.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Penetration testing and bug bounty
Someone friendly finds the holes before someone hostile does.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.