Muse has paid out $1.2M in bug bounties, with a record $300K for one critical auth bug

armand_ruiz · x · 2026-11-03

Muse says its bug bounty program has now paid out over $1.2M to security researchers, including a record $300K single award.

The program ran privately since April and publicly since the September 8 launch, drawing 630+ submissions with 64 valid findings
The top $300K bounty, paid four months before launch, went to a researcher who found that an auth check treated a header added by a local HTTPS proxy as proof of a trusted request; a migration added a second proxy layer, letting outside requests forge the trusted header and access conversations and tokens in employees' pre-release VMs
Muse notes its maximum award is several times higher than other major AI labs' published caps, and frames bounties as scalable adversarial testing

More from Safety