{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/salt-labs-manus-email-injection-2026/",
 "asOf": "2026-10-30",
 "id": "salt-labs-manus-email-injection-2026",
 "date": "2026-10-01",
 "datePrecision": "day",
 "title": "Salt Labs reports a resolved Manus flaw that ran injected code before warning",
 "lane": "attack",
 "kind": "vulnerability-disclosure",
 "summary": "Salt Labs reports a researcher-controlled email injection that caused Manus to run untrusted code when asked to read an inbox, before displaying a security warning. The researchers describe access to the user’s sandbox and connected-account tokens, including Gmail and potentially other connected services. Salt says the reported flaw has been resolved and is no longer exploitable; the post does not establish an attack campaign against real users.",
 "whyItMatters": "It distinguishes detecting a suspicious instruction from enforcing a decision before that instruction produces an external effect.",
 "actors": [
  "salt-security",
  "manus"
 ],
 "topics": [
  "prompt-injection",
  "tool-and-mcp-security",
  "data-exfiltration",
  "access-controls"
 ],
 "atlas": [
  "untrusted-content",
  "tools",
  "credentials",
  "human-approver"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email",
   "publisher": "Salt Labs",
   "title": "How We Hijacked an AI Agent With a Single Email",
   "date": "2026-10-01",
   "type": "primary",
   "accessed": "2026-10-13"
  }
 ],
 "keyFacts": [
  {
   "fact": "The demonstration used a Gmail account connected to Manus and required the user to ask Manus to read email; Salt says no link click or stolen password was needed. This is a research demonstration, not evidence of a zero-interaction attack against uninvolved users.",
   "locator": "Executive Summary; How does Manus actually process an email behind the scenes?"
  },
  {
   "fact": "Salt says Manus executed obfuscated untrusted code in the cloud sandbox before a warning requested approval. Direct instructions and several other tested forms were blocked before execution.",
   "locator": "Manus Guardrails Bypass"
  },
  {
   "fact": "Salt reports that the sandbox held the Gmail access token and could hold tokens for other services the user had connected, such as Google Drive and GitHub. The scope depends on the user’s configured integrations; it is not access to every account the user owns.",
   "locator": "Manus Guardrails Bypass, final paragraphs"
  },
  {
   "fact": "Salt states that the flaw has been resolved and is no longer exploitable, and describes preparing a responsible disclosure report for Meta’s bug bounty program. The post does not establish submission, describe a retest, name a fixed version or provide a vendor statement.",
   "locator": "Executive Summary; Manus Guardrails Bypass, final paragraphs"
  }
 ],
 "significance": 4,
 "fideQuestions": [
  "FID-076"
 ],
 "methods": [
  "approval-bypass",
  "credential-overreach",
  "human-approval",
  "indirect-prompt-injection"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-13",
 "revisions": []
}