Manus AI Prompt Injection Flaw Let One Email Run Code

What happened

Security researchers at Salt Labs found a way to get Manus, the general-purpose AI agent, to execute attacker-supplied code after reading a single crafted email 2. The problem has since been patched 2. The attack chain shows how easily the guardrails around agentic AI can be sidestepped when the agent has broad access to a user's accounts.

The researchers targeted Manus's Gmail integration 2. Their first attempt was simple: an email containing a hidden prompt. Manus did flag that message as malicious, but Salt Labs pointed to a more worrying detail. The agent was not treating the email as passive content. It tried to carry out the embedded instructions and was stopped only when a separate security mechanism recognized the action as dangerous 2.

The team then tried to slip instructions past that safety net. They encoded prompts in Base64 and asked the agent to decode and run them with Python 2. The approach that finally worked used JSFuck, an obscure JavaScript obfuscation technique 2. It builds working code from a tiny set of characters and is seldom used in modern software. According to the report, the hidden prompts were decoded and executed before Manus noticed anything suspicious 2.

Why the technique matters more than the patch

The specific JSFuck route is closed. The larger lesson is that the first line of defense, the detection layer, appears to work like a pattern-matcher rather than a guarantee. Salt Labs' own framing points that way: this technique was fixed, but others that work just as well are probably still out there 2.

The researchers' observation that Manus treated email content as instructions points to the core weakness of language-model agents. They have no reliable boundary between data they are reading and commands they should follow. When a filter catches the obvious cases but misses an encoded variant, it is playing catch-up. Attackers can try encoding after encoding, while defenders have to anticipate every one.

The report also suggests this is not Manus's first run-in with email-borne prompt injection. It opens by warning readers who believed such attacks were "a thing of the past" 2. Details of the earlier issue are not laid out here. Still, a repeat of the same attack class through the same channel is a meaningful signal for anyone deciding whether to connect the agent to sensitive accounts.

The compliance-versus-reality gap

On paper, Manus looks well prepared. Its Trust Center lists SOC 2 Type II, ISO 27001, and ISO 27701 certifications, data storage in the US and Singapore, and contracts that bar model providers from training on customer data 1. A recent review counted this "security paperwork" among the product's strengths 1.

Those credentials matter for data governance and operational controls. But they say little about whether an agent can be tricked by the content it processes. The two sources point at different layers of risk. Certifications cover how a vendor stores and handles your data. Prompt injection concerns what the agent does once it has permission to act for you. A company can pass audits and still ship an agent that runs instructions hidden in an inbox.

Context: a turbulent vendor

The flaw arrives during an eventful stretch for the company. The same review describes a deal involving Meta followed by a buyback that made Manus independent again 1. It also cites an August data deletion as evidence that a vendor's corporate events can reach customer files 1. The review notes that Manus runs tasks either on a cloud computer or inside the user's own browser 1. Both modes give the agent real reach into a user's digital life.

The review also points out that each Manus task inherits a project's setup but keeps its results to itself, with no documented write-back to shared memory 1. That limitation is about productivity, not security. But it underlines that Manus is still a maturing product being handed significant access.

The takeaway

This incident is best read as a structural warning more than a one-off bug. Manus responded by fixing the reported method, which is the right move. Yet the attack shows that detection-based defenses against prompt injection can be beaten with enough creativity. The more third-party services an agent can reach, such as email and browsers, the larger the blast radius when that happens 2.

For users and IT teams, the practical step is to limit what Manus and similar agents can touch. That means scoping integrations narrowly and treating any agent that reads untrusted content, especially email, as a potential execution path. Compliance badges are a baseline, not proof that an agent can tell a message from a command.