Meta paid a researcher $300,000 for discovering an authentication flaw that exposed conversations and access tokens on virtual machines used to test its Muse AI agent. The vulnerability was discovered roughly four months before Muse's Sept. 8 launch, and Meta says it shut down the affected service and fixed the issue during early internal testing.
The award was the largest in Muse's bug bounty program, which has paid approximately $1.2 million across 64 valid findings from more than 630 submissions. Meta's latest disclosure also details prompt-injection attacks, credential-filtering weaknesses, and vulnerabilities in its Android and Mac apps.
How the $300,000 authentication flaw exposed internal Muse data
According to Meta's Nov. 2 disclosure, the vulnerability originated in an authentication check that trusted a header added by a local HTTPS proxy.
A system migration introduced a second proxy layer, allowing external requests to carry the same trusted header. A researcher exploited that weakness to access conversations and tokens stored on pre-release virtual machines used by Meta employees and engineers.
Meta says it shut down the service, fixed the vulnerability, and removed the assumption that requests originating locally were inherently trustworthy.
The company has not disclosed how many test machines were exposed, what permissions the affected tokens carried, or whether those credentials were revoked.
Meta also disclosed four other rewarded findings:
- $90,000 for prompt injection: A malicious web page imitated Muse's browsing-tool messages and persuaded the agent to perform actions its safeguards should have blocked.
- $90,000 for passcode filtering: Specially formatted text bypassed email redaction filters designed to protect one-time passcodes.
- $50,000 for an Android vulnerability: A malicious app could load an attacker-controlled page into a privileged web view and potentially obtain its credentials.
- $1,000 for a Mac vulnerability: An attacker with access to the computer could abuse Muse's automatic update mechanism to execute code with the application's privileges.
Meta says it corrected the reported weaknesses. For the browsing-tool attack, its internal classifiers now reportedly detect the original technique and 100 variations.
The findings extend beyond model behavior. Organizations also need to identify where agents store credentials and what data they can access. Microsoft's Defender and Purview controls address visibility into locally running AI agents and potential data exposure.
Meta's disclosure does not include independent validation of the improved detection results or a false-positive rate.
What eWeek found: three security checks enterprises should prioritize
The $300,000 vulnerability was an authentication failure, not an AI model exploit. A system migration changed which requests could carry a trusted header, allowing an attacker to cross a security boundary.
The other findings exposed weaknesses in how Muse interpreted web content, protected credentials, and handled application privileges.
For organizations deploying AI agents, three checks emerge from the disclosed vulnerabilities:
- Authentication and infrastructure changes: Verify authentication across proxy layers and retest trust assumptions after migrations. Internal-origin headers should not automatically grant access to sensitive conversations or credentials.
- Agent permissions and tool output: Prevent untrusted web content from authorizing sensitive actions. Restrict agent privileges and require confirmation for consequential operations. Microsoft's dynamic agent permissions provide one approach to limiting access as agent risk changes.
- Credential isolation and recovery: Determine where tokens are stored, what permissions they carry, and how quickly they can be revoked. AI agents connected to multiple business applications create additional exposure when credentials are compromised. Enterprise identity controls are increasingly being designed around these access challenges.
Meta's disclosure confirms that researchers accessed conversations and tokens in pre-release testing. It does not establish a compromise of production users.
However, the company has not published the number of affected machines, the scope of the exposed credentials, or an independent assessment of its prompt-injection defenses.
Enterprises evaluating Muse should request evidence that authentication boundaries have been retested, credentials are appropriately isolated, and prompt-injection safeguards work beyond the specific attacks demonstrated in the bounty program.
Meta's public bounty program remains active, offering up to $300,000 for qualifying reports, including up to $130,000 for prompt-injection attacks affecting a single user.
Separately, Meta paused Muse's sharing feature after sensitive AI conversations became publicly discoverable, raising additional questions about how the agent protects user information.