Meta will give select researchers test VMs to probe Muse’s isolation boundaries

Meta is giving select bug bounty researchers dedicated test Muse accounts, controlled access to their own test virtual machines, and private tools to study Muse’s security boundaries. The research environment is being introduced at a Tokyo live hacking event on 16 November, according to a Meta Bug Bounty blog post.

David Singleton, who works on Muse at Meta Superintelligence Labs, said the company has been talking with security researchers about making Muse, Meta’s personal AI agent, even easier to test, and that he is looking forward to giving select researchers the test VMs and tools to probe its isolation boundaries.

We’ve been talking with security researchers about making @muse even easier to test. Looking forward to giving select bug bounty researchers dedicated test VMs and tools to probe our isolation boundaries.

November 13, 2026

Testing is limited to those dedicated event accounts, each researcher’s own test Muse, and the event’s approved scope. Meta says no real user accounts or production data are involved. Early access is by invitation. Approved participants get private guidance on the testing limits and how to use the tools. During early access the tools and the detailed guide stay private, and participants get them only for a limited time.

What the test VMs are for

Muse runs its tools in an isolated runtime cell. The services that protect credentials, and that control approvals and network access, sit apart from that cell. Tarek Sheasha sets the split out in How We Built Safety Into Muse. Each user gets a dedicated cloud VM. The agent harness and the user’s workspace live in the runtime cell. Credential storage and safety classifiers stay outside it, as does Sentinel, which is the only authority that can approve connector actions and network egress.

Meta says the setup is lighter, and that researchers get a clearer view of the system. The point, it says, is to let them test an attack hypothesis, check a finding and show the impact. On those test VMs, researchers can look at the interfaces and controls around the runtime cell. Until now, Meta says, they have had to infer how the isolation works from the product’s black-box behaviour alone. From approved sandbox contexts, they can use synthetic files and data to test the boundary between the runtime cell and the security-sensitive services. Agent-assisted workflows are there to compare behaviour, run experiments and organise evidence.

Participants also get Muse Code, Meta’s terminal coding agent, for that work. Defining the attack hypothesis, checking the finding and showing the impact still sits with the researcher, Meta says.

The bounty programme stays open

The Muse bug bounty programme has covered the product privately since April and publicly since the 8 September launch. Official payout guidelines cap awards at US$300,000, including up to US$130,000 for compromise of a specific user’s Muse agent. At launch, Meta also said the US$130,000 figure covered a successful prompt injection attempt that affects one user.

In an earlier post, Singleton said the programme had paid out more than US$1 million, including US$300,000 to a researcher who found what he called the most critical bug they’ve seen in Muse. The official Muse blog, also under his name, says there have been more than 630 submissions, 64 valid findings, and about US$1.2 million awarded. The US$300,000 award went out four months before launch. The bug let a researcher reach conversations and tokens in the pre-release VMs that staff and engineers were using to test the product. Meta says it took the service down, fixed the issue, and stopped trusting the local machine.

We’ve now paid out more than $1M in @muse bug bounties. That includes $300,000 to a security researcher who found the most critical bug we’ve seen in Muse.

November 3, 2026

After the Tokyo event, Meta says it will take the feedback, keep work on the tools, and widen access carefully as the controls, documentation and tooling settle. Anyone who isn’t invited can still file reports through the regular Bug Bounty programme.