SALT Labs researchers identified a prompt-injection vulnerability in Manus, an agentic AI platform that can automate tasks and connect to services such as Gmail, Dropbox and GitHub. In testing, the researchers sent a Manus user an email containing an instruction to run `whoami`. Manus blocked that straightforward attempt, but later accepted the same type of instruction when it was concealed using the JavaScript obfuscation technique JSFuck. Although Manus displayed a security warning, the payload had already run.
The researchers said they then used a remote code execution (RCE) flaw to create a reverse shell within the application. From there, they were able to locate credentials and tokens for third-party services connected to the victim’s Manus account. An attacker could consequently have accessed linked email, storage and coding accounts. The report describes a demonstrated test attack and potential account compromise, not confirmed exploitation against users in the wild.
Salt Labs said it reported the issue to Manus without receiving a response. After the researchers submitted it through Meta’s bug-bounty programme, Meta triaged and confirmed the vulnerability and patched it. Manus and Meta remained separate after Meta’s proposed acquisition of Manus fell through. Salt Labs warned that built-in AI guardrails are not sufficient on their own, recommending layered defences for agentic systems that process untrusted external data.