Meta bug bounty pays up to $300K per report, including $130K for single-user prompt injection
jeff_weinstein · x · 2026-11-03
Meta detailed its bug bounty program and a new incentive: reports pay up to $300K (Mobile RCE, WhatsApp Private Processing, Muse VM Escape), including up to $130K for a prompt injection against a single user — several times the published maximums at other major AI labs. Other tiers include $130K for account takeover, $30K for a Quest persistent secure boot bypass, $20K for 2FA bypass, down to a $500 minimum. Scope spans Facebook, Instagram, WhatsApp, Meta Quest, Ray-Ban Stories, and Meta AI. Bounties donated to charity are doubled, and total rewards to date exceed $33M.
More from Safety
- Simple prompt rule stops AI agents from touching your PayPal, Stripe or bank without asking — TawohAwa · 2026-11-03
- Frontier AI labs accused of 'extortion racket': selling cyber defense for risks they created — Graham_dePenros · 2026-11-03
- CPS prosecutor cited imaginary legal case in high court after AI search, Guardian reports — nordicinst · 2026-11-03
- If an agent can edit its own spending cap, was it ever a cap? — quiet_flare · 2026-11-03
- Reverse game theory: designing incentives that make rule-following the rational choice for AI — MIT Tech Review AI · 2026-11-03
- OpenAI quadruples bug bounty payouts, tops out at $172,000 per vulnerability — The Decoder · 2026-11-03