Around Muse’s public launch on September 8, Meta said it had paid roughly $1.2 million in bug bounties tied to the product, following a private testing program that started in April.
The largest single award, $300,000, went to a pre-launch flaw that exposed conversations and tokens on internal Muse test VMs. For a tool plugged into email, calendars, messaging, and other services, that’s a major exposure, Meta said.
The company traced the problem to an authentication check that incorrectly trusted a header coming from a local HTTPS proxy. Once a migration introduced a second proxy, outside requests were able to include that header too.
Meta pulled Muse offline, patched the flaw, stopped automatically trusting the local machine, and said 64 out of more than 630 submitted reports were valid.
For people using AI tools that connect directly to their accounts, this disclosure lands close to home. Meta said two separate $90,000 reports involved fake browsing-status messages that pushed Muse into actions it wasn’t supposed to take, plus formatting tricks that got around one-time-passcode email redaction. On the client side, the bugs included a $50,000 Android WebView credential-capture issue, a $1,000 Mac auto-update hijack, and a later macOS zero-day that was hotfixed.
Meta also said Muse assigns each user a dedicated VM that holds emails, files, and session access. Separate outside research pointed to alleged KVM escapes and other VM-related exposure.
The company says single-user instruction-manipulation bugs can earn as much as $130,000, while fleetwide compromises can reach $250,000. Across the broader bug bounty program, Meta says it has paid more than $4 million in 2025 and over $25 million in total.
Author: Jesús Bosque
{
"de-DE": "Ich bin Journalist mit über 30 Jahren Erfahrung in Videospielen und Technologie. Obwohl Videospiele schon immer mein Fachgebiet waren, habe ich begonnen, auch die komplexen Strukturen von Projektmanagement-Tools wie Asana sowie die Automatisierungen mit Make.com und N8N zu entdecken und zu genießen.",
"en-US": "I’m a journalist with more than 30 years of experience in video games and technology. Although my specialty has always been video games, I’ve recently started enjoying exploring the intricacies of project-management tools like Asana, as well as automations with Make.com and N8N.",
"es-ES": "Soy periodista con más de 30 años de experiencia en videojuegos y tecnología. Aunque mi especialidad siempre ha sido el videojuego, he empezado a disfrutar también de descubrir los laberintos de los programas de project management como Asana y las automatizaciones de make.com y de N8N",
"fr-FR": "Je suis journaliste avec plus de 30 ans d’expérience dans le jeu vidéo et la technologie. Bien que ma spécialité ait toujours été le jeu vidéo, j’ai commencé à prendre plaisir à explorer également les méandres des outils de gestion de projet comme Asana, ainsi que les automatisations avec Make.com et N8N.",
"it-IT": "Sono un giornalista con oltre 30 anni di esperienza nei videogiochi e nella tecnologia. Anche se la mia specialità è sempre stata il videogame, ho iniziato a divertirmi anche a scoprire i meccanismi degli strumenti di project management come Asana e delle automazioni con Make.com e N8N.",
"ja-JP": "",
"nl-NL": "Ik ben een journalist met meer dan 30 jaar ervaring in videogames en technologie. Hoewel videogames altijd mijn specialiteit zijn geweest, ben ik ook begonnen te genieten van het verkennen van de ingewikkelde wereld van projectmanagementtools zoals Asana en van automatiseringen met Make.com en N8N.",
"pl-PL": "Jestem dziennikarzem z ponad 30-letnim doświadczeniem w grach wideo i technologii. Choć moją specjalizacją zawsze były gry wideo, ostatnio zacząłem również czerpać przyjemność z odkrywania zawiłości narzędzi do zarządzania projektami, takich jak Asana, oraz automatyzacji w Make.com i N8N.",
"pt-BR": "Sou jornalista com mais de 30 anos de experiência em videogames e tecnologia. Embora meu foco sempre tenha sido os videogames, recentemente passei a gostar de explorar também os labirintos de ferramentas de gestão de projetos como o Asana e das automações com Make.com e N8N.",
"social": {
"email": "jesus.bosque@softonic.com",
"facebook": "",
"twitter": "",
"linkedin": ""
}
}
View all posts by Jesús Bosque
