What Meta Reported
In a November 2, 2026 post on the Muse blog, David Singleton says the bug bounty program has covered Muse privately since April and publicly since the product's September 8 launch. The post reports more than 630 submissions, 64 valid findings, and about $1.2 million in payouts to date. These are Meta's own figures, and the post gives no breakdown by severity or by period.
Two Reports in Detail
The largest award, $300,000, was paid four months before launch. According to the post, a researcher demonstrated access to conversations and tokens in pre-release virtual machines used by employees and engineers testing Muse, through a flaw in an authentication check. Meta says the product was in early internal testing, that it shut the service down and addressed the issue immediately, and that it went on to remove all trust in the local machine. This is Meta's account of a researcher demonstration on a pre-release system, not a confirmed breach affecting public users. The post does not say whether anyone else used the flaw or how much data was reachable.
A $90,000 award covered an indirect prompt injection. A web page imitated status messages from Muse's browsing tool and, when a user asked Muse to summarize it, got the agent to execute some actions that should have been caught. Meta says it added detection signals and changed how Muse handles suspicious tool output. In Meta's own testing, its classifiers now flag the original attack and 100 variations of it. The post does not explain how those variations were made, and it reports neither false positives nor results on attacks outside that set.
The post also lists reports on one-time passcode redaction, an Android app credential issue, and privilege escalation in the Mac app. In all, it describes five paid reports, against 64 valid findings.
What the Figures Do Not Show
Our editorial reading is that a bounty total shows what was reported, validated, and paid, not how many flaws remain. The post cites no independent test of the fixes and does not claim complete coverage. Meta's launch safety post itself says Muse "isn't immune to attack" and that prompt injection "remains an open problem in the industry." That post and the September 8 announcement describe controls such as Muse Secure VM and the Sentinel agent, which are also vendor descriptions.
The post does not mention the cloud flaw reported in September, and nothing in it ties that report to the $300,000 finding.
Separate From the Model Safety Report
This is a product security disclosure. It is separate from the Muse Wonder model card and from the fuller safety report that Meta's Wonder post says "will be available soon," which we covered in October. That material concerns model evaluations and risk thresholds, and the November 2 post does not mention Wonder. Neither set of figures can stand in for the other.
Questions for an Audit
Our editorial recommendation is to request what the post omits: findings by severity and date, whether any flaw was used outside research, how exposed tokens were handled, and retest results on held-out attacks with false positive rates. For a worked method, see Audit an Agent Action.
Follow Audit Commons
Keep up with new reporting, practical guides, and resources in your feed reader.