Salt Labs Hijacks Manus AI Agent Through a Prompt-Injected Email

Sourcing note: the primary report is Dark Reading (September 24, 2026). We could not read its full text, so details below come from secondary summaries of it and should be checked against the original and Salt Labs’ own write-up.

Researchers at Salt Labs reported a prompt-injection flaw in Manus, an agentic AI app. They placed instructions inside an email that Manus would later process. A plain request to run a command was caught by Manus’s security warnings. The researchers got around that by encoding the payload with JSFuck, a JavaScript obfuscation technique, so the code ran before the warning triggered. They then opened a reverse shell and located credentials and tokens tied to the victim’s connected third-party apps.

The flaw is reported as fixed. Summaries differ on whether Manus or Meta’s bug bounty program handled the report.

Pattern match: untrusted content (an email) carried instructions the agent executed (Indirect Prompt Injection), and the agent had code execution and access to connected accounts well beyond what reading an email requires (Excessive Agency).

The fix: keep untrusted content away from code-execution tools, run agent code in an isolated sandbox without stored credentials, and treat input filters as a speed bump rather than a boundary.