Salt Security

Salt Labs reports a researcher-controlled email injection that caused Manus to run untrusted code when asked to read an inbox, before displaying a security warning. The researchers describe access to the user’s sandbox and connected-account tokens, including Gmail and potentially other connected services. Salt says the reported flaw has been resolved and is no longer exploitable; the post does not establish an attack campaign against real users.