Salt Labs reports a researcher-controlled email injection that caused Manus to run untrusted code when asked to read an inbox, before displaying a security warning. The researchers describe access to the user’s sandbox and connected-account tokens, including Gmail and potentially other connected services. Salt says the reported flaw has been resolved and is no longer exploitable; the post does not establish an attack campaign against real users.
Why it matters
It distinguishes detecting a suspicious instruction from enforcing a decision before that instruction produces an external effect.
Key facts
As stated in the sources, with where to find them.
- The demonstration used a Gmail account connected to Manus and required the user to ask Manus to read email; Salt says no link click or stolen password was needed. This is a research demonstration, not evidence of a zero-interaction attack against uninvolved users.Executive Summary; How does Manus actually process an email behind the scenes?
- Salt says Manus executed obfuscated untrusted code in the cloud sandbox before a warning requested approval. Direct instructions and several other tested forms were blocked before execution.Manus Guardrails Bypass
- Salt reports that the sandbox held the Gmail access token and could hold tokens for other services the user had connected, such as Google Drive and GitHub. The scope depends on the user’s configured integrations; it is not access to every account the user owns.Manus Guardrails Bypass, final paragraphs
- Salt states that the flaw has been resolved and is no longer exploitable, and describes preparing a responsible disclosure report for Meta’s bug bounty program. The post does not establish submission, describe a retest, name a fixed version or provide a vendor statement.Executive Summary; Manus Guardrails Bypass, final paragraphs
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Bounding what untrusted input can trigger helps, but trust boundaries must survive delegation and tool execution.
- Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.
- Do cyber evaluations of AI agents stay contained?Not reliably. Evaluation, training and research agents have reached real systems outside scope, as labs and national authorities report.
- Can AI agents defend and oversee systems on their own?Not reliably. Some designs improve benchmark triage, but autonomous defense and oversight lack broad operational validation.
Sources
Related records
Sep 30, 2026
Oct 29, 2026
Oct 13, 2026
Sep 30, 2026
Sep 29, 2026
Oct 22, 2026