Meta Awards $300,000 for Critical Vulnerability in Internal AI Agent Muse
Meta has awarded a substantial bug bounty for a pre-launch flaw in its internal AI agent, Muse, which could have exposed sensitive employee data and authentication tokens.
Meta has revealed that its bug bounty program for its internal AI agent, Muse, has resulted in significant payouts, including a top award of $300,000 for a critical vulnerability discovered before the agent's public launch. The flaw, identified during early internal testing, allowed a researcher to access conversations and authentication tokens on test virtual machines used by Meta employees.
Muse is designed as a personal AI agent intended to act on behalf of users across their various accounts, including email, calendar, and messaging. Each instance of Muse operates within its own virtual machine, creating a unique environment for each user. The bug bounty program, initially private, transitioned to public status on September 8, coinciding with Muse's official launch. Out of over 630 reports submitted, Meta validated 64 as legitimate security findings.
The most significant vulnerability, which earned the $300,000 bounty, was discovered approximately four months prior to Muse's launch. The researcher exploited a misconfiguration in an HTTPS proxy that incorrectly treated a header added by a local proxy as a sign of a trusted source. This allowed external requests, during a system migration that introduced an additional proxy layer, to bypass security checks and gain access to sensitive data on internal test systems.
In response to this critical finding, Meta promptly took the affected service offline, implemented a fix for the authentication bypass, and revised its trust model for local machines. This swift action aimed to prevent any potential exploitation of the vulnerability in the production environment. The company's proactive approach to addressing such flaws underscores its commitment to securing its AI infrastructure.
Beyond the top award, Meta also issued a $90,000 bounty for a separate issue where a malicious webpage, when summarized by Muse, mimicked the agent's browsing tool status messages. This allowed the agent to execute actions that should have been blocked. Meta has since enhanced its detection mechanisms and modified how Muse processes suspicious tool outputs, reporting that its classifiers now successfully identify this attack and numerous variants.
Another $90,000 bounty was awarded for a vulnerability related to one-time passcodes (OTPs). Specific formatting could bypass Muse's email redaction filters, allowing sensitive OTPs to be exposed. Meta described this as a component of a larger, end-to-end attack chain. Additionally, a $50,000 reward was given for an Android app flaw that enabled a malicious app to load a privileged web view with credentials, and a $1,000 bounty covered a flaw in the Mac app's auto-update feature that could lead to code execution.
Meta's bug bounty program offers substantial rewards, with payouts reaching up to $300,000 per valid report, positioning it as a highly competitive program in the AI security landscape. Prompt injection attacks targeting a single user can yield up to $130,000, while a widespread compromise could result in a $250,000 reward. This robust program highlights Meta's dedication to leveraging external security researchers to identify and remediate vulnerabilities in its cutting-edge AI technologies.