Meta Shares Top Muse AI Agent Bug Bounty Findings Reaching $1.2 Million
Meta paid $1.2 million in bug bounties for vulnerabilities in its Muse personal AI agent, including pre-launch flaws.
1
Stories per day · 30 days
4 RSS
Relatedopenai8ai-security3hackerone3security-research3ai-agents2anthropic2chatgpt2codex2ctf2google2google-cloud2microsoft2msrc2php2prompt-injection2sandbox-escape2third-party2vulnerability-disclosure2
64 stories, newest first · one card per story
Stories tagged #bug-bounty
OpenAI Quadruples Bug Bounty Payouts to $172000
OpenAI has increased critical vulnerability payouts to $30k with exceptional findings up to $100k reaching $172k total.
OpenAI Increases Bug Bounty Rewards Up to $172,000
OpenAI quadrupled midpoints for critical vulnerabilities in ChatGPT, Codex and API with bonuses up to $172,000 and a five-tier loyalty program.
HackerOne CEO says humans still better than AI at judging business impact of vulnerabilities
According to HackerOne CEO Kara Sprague, humans excel at assessing business consequences of flaws while AI finds vulnerabilities at scale
1
Google Offers $250,000 Root-in-Cloud Bug Bounty for Cloud Takeover
Google offers $250,000 for researchers to demonstrate complete administrative takeover of arbitrary projects or organizations without prior access.
1
OpenAI Launches New Security Sprint to Hunt Vulnerabilities
The sprint pairs OpenAI models with Cathedral Systems researchers to continuously test and strengthen defenses while raising critical bug bounty rewards.
1
OpenAI raises bug bounty payouts, critical findings up to $30,000
Exceptional critical findings stay eligible for $100,000, or up to $172,000 with bonuses.
1
OpenAI plans security sprint with Cathedral Systems
OpenAI says critical bug-bounty rewards more than quadrupled and pledges $1 billion in subsidized Daybreak access over six months.
1
Google adds $250,000 root-in-cloud bug bounty reward
New tier rewards researchers for proving full administrative control over Google Cloud organizations without prior access.
1
Beginner guide on bug bounties as AI reports strain programs
Curl ended its paid bounty on January 31, 2026 after confirmed findings fell below 5%, then later recovered near 15%.
1
ChatGPT share links could run code in a signed-in session
Parameter reported the P1 issue on October 18; OpenAI fixed both web frontends by October 26 and paid $5,000.
Opinion: CTF contests may offset shrinking entry-level security jobs
A Five9 engineer who won SentinelOne's Sentinels League argues CTFs still build judgment as AI crowds out junior roles.
1
Wordfence July 2026 bounty program received 1,077 reports
Validated WordPress plugin and theme flaws are disclosed to vendors and can get firewall coverage.
AI agents accessed Anthropic systems via third-party software
Anthropic says sales, HR, and IT data were exposed, but Claude chats, source code, and weights were not.
1
Cloudflare opens PHP CTF for php2shell WAF bypasses
HackerOne participants must get code execution on PHP 8.5.11, read a resetting flag, and privately report a distinct bypass.
Researchers bypass OpenAI’s August fix for reasoning-trace theft
Xint recovered raw traces from gpt-4.1 and gpt-4o via compaction and tab substitution; OpenAI confirmed, mitigated, and paid a bounty.
1
Cathedral AI agents reached Anthropic business systems in authorized test
Agents used unnamed third-party software to reach sales, HR, and IT data; prompts, source code, and model weights were not accessed.
Steal My Bitcoin offers about $500 to the first successful hacker
The wallet is reachable by the PHP user through a print-flag binary, and operators say all traffic is logged.
Apple accepts Security Research Device applications through October 30
Approved researchers get a 12-month loaner iPhone with shell access, custom entitlements, and kernel changes.
Bug bounty sharpens researcher security skills
GitHub spotlight researcher r31n who improves skills through validation and proof of concepts on GitHub Enterprise.
1
Muse share links expose private chats through DNS-visible names
Claroc enumerated 6,800 links from passive DNS; Meta has paused sharing while it reviews the report.
Pentera says the harness, not the model, makes agentic pentesting safe
Pentera Apps pairs a model that chooses tests with code that logs, pauses, and stops every action, and ships replayable exploit scripts.
2
Microsoft ties Azure bounty payouts to report completeness
From October 20, complete critical RCE or privilege-escalation reports can pay $40,000, versus $4,000 if incomplete.
Microsoft ties bug bounty rewards to Complete versus Not Complete reports
Reports filed on or after October 20, 2026, at 8 AM Pacific need a PoC and exploitability details to count as Complete.
5