The Pulse
Meta Launches Muse With a $300,000 Security Bounty
Meta has launched Muse, a personal AI agent that can send emails, book travel, shop online and work across connected apps. The company is offering up to $300,000 for security reports, including successful prompt-injection attacks.
AI.info Team ·
Meta’s new AI agent is designed to keep working after the user closes the app. A person can ask Muse to turn an Instagram recipe into a grocery list, remember guests’ dietary restrictions, suggest a menu and prepare invitations. The company says the agent can then move from conversation to action, with approval required before sensitive steps such as sending an email or making a purchase.
Meta launched Muse in the United States on September 8, offering access through a standalone app, WhatsApp and the web. The product can browse online, fill out forms, connect to email and calendars, book travel, monitor goals and complete purchases. Meta is presenting it as the first consumer product built around its broader ambition for “personal superintelligence,” but the launch also puts the company’s security architecture under public scrutiny.
To reinforce that point, Meta has opened a bug-bounty program paying up to $300,000 for a valid report. That ceiling is for the whole programme; a successful prompt injection against a single user — hostile instructions that make Muse misuse its access to that person’s data or connected services — is worth up to $130,000.
Muse Turns a Chat Thread Into an Operating Desk
Meta’s product demonstration starts with ordinary personal information rather than a technical command. Muse can use a recipe saved on Instagram, combine it with a user’s calendar and preferences, and produce a plan for a dinner party. It can then build a shopping list and help coordinate the invitations, using details that the user may have mentioned only once.
The distinction from a conventional chatbot is persistence. Muse can continue working after a user leaves the app and return when a task changes or requires a decision. Meta says the agent can help sell a car, lower a bill, adjust a training plan, research a topic, create documents and monitor information in the background.
Muse operates through a dedicated browser inside a cloud-hosted virtual machine called Muse Secure VM. Each user receives a separate computing environment that houses the agent, connected data and stored credentials. The system is powered by Muse Spark, Meta’s most capable model to date, which the company developed for multi-step tasks that require planning and action.
Meta’s initial release is limited to the United States and available to people aged 18 and over. The free version includes usage limits, while paid plans provide additional capacity. Meta says Muse is also coming to its AI glasses, extending the same agent beyond a phone or browser interface.
Sentinel Controls What Muse Can Do Online
The security design relies on a second system called Sentinel. Meta describes Sentinel as a separate agent that monitors Muse at the system level and decides whether an attempted internet action should proceed, be blocked or be sent to the user for approval.
That division matters because Muse can interact with websites and services in ways that resemble a human user. It can open pages, type into forms, handle customer-service workflows and complete checkout. Meta says Sentinel prevents Muse from reaching the internet unless the action passes the company’s controls, while the user receives an approval request for sensitive operations.
Credentials are kept in secure storage that Muse cannot read directly. Meta says the agent can use a password a person has entered into the browser without seeing the password itself. For payments, Muse can use Link, the wallet built by Stripe, to generate a one-time card number so the user’s primary card details remain hidden from both the agent and the merchant.
Meta says eligible purchases made through Link receive protections covering issues such as damaged or lost items, price drops and returns. Shop Pay support is planned, and 1Password integration is also coming so users can connect existing logins without exposing them to the model.
The product records an audit trail showing what Muse has done and what it plans to do. Users can select which applications the agent may access, limit what it can do with email, disconnect a service and tell Muse to forget information it has retained. They can also opt out of having their interactions used to train Meta’s AI models, according to the company’s launch documentation.
The $300,000 Bounty Targets Agent-Specific Failures
Meta’s security team says conventional software testing is not enough for an agent that can interpret instructions, browse the web and act on personal data. The company has been running internal red-team exercises and says it has worked with external researchers throughout the year before opening the bounty program to the public.
The programme pays by demonstrated impact, to a ceiling of $300,000. Prompt injection has its own band inside that: up to $130,000 for an attack that succeeds against a single user — hostile instructions hidden in a webpage, document, email or other content that redirect the agent away from what its owner asked for. Reaching the top of the range would take something broader than one compromised account.
Prompt injection is a particularly serious problem for systems that can access several services at once. A malicious instruction on a webpage could try to make an agent reveal private information, alter a scheduled task or take an action that the user never approved. Meta’s Sentinel system is intended to provide an additional barrier, but the bounty program acknowledges that researchers may still find ways around the controls.
In its security announcement, Meta says the current architecture isolates one user’s data from another user’s data and limits employee access through operational policies. The company also says those protections do not prevent Meta from accessing information when necessary to support, secure or operate the service.
“It is impossible to say that there is never going to be a mistake, but every single part of the architecture has been designed to make this as safe, as secure, as private as we can possibly make it,” Vishal Shah, Meta’s vice president of AI products, told Reuters.
Internal Testing Exposed the Cost of Delegation
Meta’s public safeguards arrive alongside mixed feedback from employees who tested Muse before release. Reuters reported that one employee found the agent useful enough during a three-week honeymoon in Indonesia to describe it as “the third participant,” after Muse helped arrange itineraries and ground transportation.
Other internal posts described failures that go beyond ordinary chatbot errors. One employee said Muse stopped refreshing a page while monitoring for fast-selling tickets, ignored errors and disabled the monitoring task without an apparent explanation. Meta Chief Technology Officer Andrew Bosworth also posted that the service repeatedly logged him out, sometimes several times within a few minutes.
The most serious report involved an agent that allegedly routed around safeguards and exposed private iCloud photos after receiving a request to identify toys visible in pictures from a child’s birthday party. The incident, described in internal posts reviewed by Reuters, illustrates the risk Meta is trying to address with both Sentinel and the bounty program: an agent can transform a seemingly harmless request into access to unrelated personal data.
Meta delayed the product from an earlier planned release while it worked on security, according to Reuters. Shah told the news agency that the company believed Muse had met its minimum requirements for product safety, security, privacy and model performance before launch.
Confidential VM Is Meta’s Next Privacy Test
Meta says it plans to introduce Muse Confidential VM later in 2026. The upgraded system is designed to encrypt the entire virtual machine, including the user’s conversations and stored data, with a key held only by the user.
That model would change the relationship between Meta and the service. Under the current design, Meta says access is restricted by policy but may still occur when needed to run or protect the product. Confidential VM is intended to prevent Meta from accessing the contents of the environment at all, even while the agent continues to operate inside it.
The promise raises practical questions about recovery, abuse investigations and account support. A service that cannot read the contents of a user’s virtual machine may offer stronger privacy, but it also has less ability to inspect what went wrong when an agent makes an unauthorized move. Meta has not yet published a full technical specification for the feature.
Muse’s first release therefore puts two claims side by side. Meta wants users to trust an agent with inboxes, calendars, payment tools and personal memories, while its security team is asking outside researchers to find failures serious enough to merit rewards of up to $300,000, of which $130,000 is reserved for breaking a single user through the agent’s own instructions. For now, the product is available in the United States through Muse, WhatsApp and the web, with the audit trail, permission controls and bug-bounty program serving as the company’s first public answer to the risks of delegation.