- More than 630 submissions to the Muse bug bounty program.
- 64 were confirmed as valid findings.
- Total payouts so far: about $1.2 million.
- Found four months before Muse launched.
- An authentication flaw exposed internal testers' tokens and conversations.
- Meta paid $300,000 for that single report.
- Prompt-injection bounties against a single user run up to $130,000.
- Muse asks users to hand an agent access to email, accounts, and purchases.
- A security failure in the agent can become an account failure for the user.
- The bounty totals show how Meta prices agent-specific attacks.
Useful?