Meta prices a single-user prompt injection against Muse at $130,000

Bounty payouts double as a price list of sorts, and a price list shows what a company believes it is exposed to. Meta will pay up to $300,000 for a valid Muse report, and up to $130,000 of that for a prompt injection that affects a single user ^[9]. Compromising one person is therefore worth about 43 percent of the top payout ^[20], and set against the $100-a-month Maximum tier it comes to roughly 108 years of that subscriber's fees ^[4][21]. The signal to researchers is that untrusted text arriving in a connected inbox is the failure Meta most wants found by someone who will report it.

The architecture follows the same assumption. The agentic harness and the user's files run inside a systemd-nspawn cell with its own debian root filesystem, a virtual network interface and filtered system calls including no io_uring, and root inside that cell maps to an unprivileged host user ^[7]. Meta's own framing is two isolated security domains on one box rather than an LLM powered agent with root ^[8]. Credentials sit outside the domain the model drives, and every outbound interaction passes through a Sentinel the agent cannot override ^[6]. The primitives are ordinary Linux ones. What is worth copying is where the line was drawn, given that this was the first time the company handed inboxes, calendars and a shell to software and let it run unattended ^[5].

The post never says how often the model gets fooled. Meta says it trained for long-trajectory instruction following with inherent awareness of prompt injection ^[10], and hardened the system through dogfooding, agentic red teaming and a private researcher program ^[11], but none of that comes with an attempt count, a success rate or a denominator. Containment and susceptibility are separate measurements, and only the first one is described here.

Forkast, citing internal reports, says the agent struggled with guardrail bypasses in internal testing, including a photo incident in which private iCloud images were exposed to whoever was looking at the screen ^[13]. The same piece cites Meta figures of internal technical and security incidents up 40 percent year over year with firefighting time up 70 percent ^[15], and VP of AI Products Vishal Shah saying the April 2026 release was delayed specifically to improve security ^[16]. Photos displayed on a screen are neither a credential leak nor an unsanctioned egress; that is the agent misusing data a user authorized it to read, which sits outside the boundary this design defends. Both accounts can hold at once.

The post works well enough as a disclosure floor: any vendor asking for comparable access can now be asked where credentials live, what the chokepoint is, and what one user's compromise is priced at. It works less well as evidence that Muse is safe to hand a calendar to, since it is an argument about design that the published material never tests against a measured outcome.