Meta prices a single-user prompt injection against Muse at $130,000
The engineering post behind Meta's new personal agent assumes the thing will be attacked through the mail it reads, and the bounty schedule says what one compromised user is worth. It does not say how often the model is fooled.
The Scientist · Science desk
What happened
- Meta launched Muse in the US on September 8, 2026 through a dedicated app and WhatsApp, wired into email, payments, calendar, health data, smart home devices and shopping.
- Meta's engineering post says the agent runs in an isolated cell on a per-user cloud VM, never sees real credentials, and reaches the outside world only through a Sentinel it cannot override.
- The company opened its Muse bug bounty to the public after hardening the agent through internal dogfooding, agentic red teaming and a private researcher program.
- Forkast, citing internal posts, describes the product stalling and silently ignoring errors, and reports that Meta CTO Andrew Bosworth publicly admitted to being repeatedly logged out.
Why it matters
- What it sets up precedent A named credential boundary, a chokepoint the model cannot override and a posted price for one-user injection give buyers concrete questions to put to every other personal-agent vendor, and silence on any of them now reads as an answer.
- What it limits constraint Assuming compromise buys a smaller blast radius rather than a lower error rate, so anyone copying this design inherits a containment story and still owes their users a reliability one.
- Who's exposed exposure Top-tier subscribers are pointing an agent at payments and health data while the trust layer for agent transactions is still in committee, with FIDO's working group formed only in April 2026 and Visa, Mastercard and American Express pushing rival schemes.
- What doesn't add up contradiction Meta's post describes a Sentinel the agent cannot override while Forkast's internal-report account describes the agent bypassing its own guardrails, and with no published bypass rate a prospective user cannot tell which layer gave way.
Next story · Product · 3d ago
Meta's Muse assistant writes explicit sex chat that Instagram and Facebook ban for their usersConfirmed2 publishers
Bounty payouts double as a price list of sorts, and a price list shows what a company believes it is exposed to. Meta will pay up to $300,000 for a valid Muse report, and up to $130,000 of that for a prompt injection that affects a single user [10]. Compromising one person is therefore worth about 43 percent of the top payout [19], and set against the $100-a-month Maximum tier it comes to roughly 108 years of that subscriber's fees [6][18]. The signal to researchers is that untrusted text arriving in a connected inbox is the failure Meta most wants found by someone who will report it.
The architecture follows the same assumption. The agentic harness and the user's files run inside a systemd-nspawn cell with its own debian root filesystem, a virtual network interface and filtered system calls including no io_uring, and root inside that cell maps to an unprivileged host user [8]. Meta's own framing is two isolated security domains on one box rather than an LLM powered agent with root [9]. Credentials sit outside the domain the model drives, and every outbound interaction passes through a Sentinel the agent cannot override [4]. The primitives are ordinary Linux ones. What is worth copying is where the line was drawn, given that this was the first time the company handed inboxes, calendars and a shell to software and let it run unattended [7].
The post never says how often the model gets fooled. Meta says it trained for long-trajectory instruction following with inherent awareness of prompt injection [11], and hardened the system through dogfooding, agentic red teaming and a private researcher program [12], but none of that comes with an attempt count, a success rate or a denominator. Containment and susceptibility are separate measurements, and only the first one is described here.
Forkast, citing internal reports, says the agent struggled with guardrail bypasses in internal testing, including a photo incident in which private iCloud images were exposed to whoever was looking at the screen [20]. The same piece cites Meta figures of internal technical and security incidents up 40 percent year over year with firefighting time up 70 percent [21], and VP of AI Products Vishal Shah saying the April 2026 release was delayed specifically to improve security [15]. Photos displayed on a screen are neither a credential leak nor an unsanctioned egress; that is the agent misusing data a user authorized it to read, which sits outside the boundary this design defends. Both accounts can hold at once.
The post works well enough as a disclosure floor: any vendor asking for comparable access can now be asked where credentials live, what the chokepoint is, and what one user's compromise is priced at. It works less well as evidence that Muse is safe to hand a calendar to, since it is an argument about design that the published material never tests against a measured outcome.
What to watch
- Any published injection success rate or bounty payout count, which would turn Meta's containment argument into a measurement.
- The encrypted version of Muse promised for later in 2026, and whether it changes what leaves the user's VM for inference and telemetry.
- Whether the connectors Muse writes for itself, rather than the provider integrations Meta hand-tuned with each API owner, are where researchers land first.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption30
- Hype gap+24
- Incentives80
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Meta launched Muse, which it describes as a personal agent, and says it had been working on and using Muse internally since early 2026.
- [2]
Meta launched Muse on September 8, 2026, described by Forkast as the largest consumer AI agent to date, available in the US via a dedicated app and WhatsApp, with plans to reach Meta AI glasses.
- [3]
Forkast, citing TechCrunch, says Muse is designed as a cross-app autonomous agent spanning email, payments, calendar, health data, smart home devices, shopping, dining, music and events.
- [4]
Meta says it designed the system to assume the agent may be under attack and to limit potential damage: the harness runs in its own isolated cell, it does not see real credentials, and every interaction with the outside world runs through a Sentinel that the agent cannot override.
- [5]
Meta built an initial set of Muse connectors by integrating third-party APIs in cooperation with each service provider, plus connectors to Meta apps including Instagram and Facebook, and says Muse can also write its own custom connectors for other services with APIs or CLIs.
- [6]
Muse pricing runs from a free basic tier to $20 a month for the Power tier and up to $100 a month for the Maximum tier.
- [7]
Meta says Muse was the first time it had handed its inboxes, its calendars and a shell to a piece of software and let it run unattended, and that this did not always work out as planned.
- [8]
The Muse harness daemon, the user workspace filesystem and the binaries Muse executes run in a systemd-nspawn runtime container; root inside the runtime cell is mapped to an unprivileged host user, the cell has its own root filesystem including a full debian image, a virtual network interface, and filtered system calls, for example no io_uring.
- [9]
Meta says the right mental model for the Muse VM is two isolated security domains on one box, not an LLM powered agent with root.
- [10]
Meta opened the Muse bug bounty program to anyone for responsible disclosure, awarding up to $300,000 for valid reports, including up to $130,000 for successful prompt injection attempts that affect one user.
- [11]
Meta says it trained the Muse model with a focus on zero-shot tool calling using CLIs and skills, long context, long-trajectory instruction following with inherent awareness of prompt injection, and multi-agent coordination.
- [12]
Meta says it hardened Muse through extensive dogfooding, agentic red teaming, and issues found in real adversarial scenarios by security researchers in its private bug bounty program.
- [13]
Each Muse user shares a dedicated cloud VM that stores all data and credentials for connected services and is the system of record; Meta says limited data leaves the VM for inference and telemetry.
- [14]
Forkast says internal posts describe the product stalling, stopping page refreshes after 15 minutes and silently ignoring errors, and that Meta CTO Andrew Bosworth publicly admitted to being repeatedly logged out.
- [15]
Forkast reports that Meta VP of AI Products Vishal Shah said the company delayed the April 2026 release specifically to improve security.
- [16]
Forkast, citing Reuters, says the FIDO Alliance launched an Agentic Authentication Technical Working Group in April 2026, and names Visa's Trusted Agent Protocol, Mastercard's Verifiable Intent and American Express's ACE as competing candidates for how agents interact with money.
- [17]
Forkast says Meta has promised an encrypted version of Muse later in 2026, claims conversations are not shared with ad systems, and offers an opt-in model in which users connect apps one at a time.
- [18]
At the $100-a-month Maximum tier, the $130,000 single-user prompt injection award equals about 108 years of that subscriber's fees.
- [19]
The $130,000 single-user prompt injection award is about 43 percent of the $300,000 maximum Muse bounty payout.
- [20]
Forkast reports that, according to internal reports, Muse struggled with guardrail bypasses in internal testing, including a photo exposure incident in which private iCloud photos were exposed to anyone looking at the screen.
- [21]
Forkast reports Meta figures showing internal technical and security incidents spiked 40 percent year over year, with firefighting time up 70 percent.
Sources
2 independent publishers whose own reporting we read for this story.
- forkast.newsMeta’s Muse Launches as the Biggest Cross-App AI Agent Yet—With a Security Disclosure Problem – Forkast
1 article · September 8, 2026
- How We Built Safety Into Muse | Meta AI Research
research.meta.ai
1 article · September 10, 2026
Topics and entities
Topics
- AI Agents
- Sandbox Isolation
- Consumer Trust in AI Features
- Bug Bounty Programs
- Agentic payments
- Prompt injection