A malicious email could hijack the Manus AI agent, Salt Labs finds

Security researchers at Salt Labs, the research arm of Salt Security, have disclosed that a single malicious email could have been enough to compromise the general-purpose AI agent Manus and reach credentials tied to a user's connected accounts.

The vulnerability has since been fixed and the attack is no longer exploitable, according to the researchers. Manus is an agentic AI platform built to handle tasks such as research, data analysis and software development on a user's behalf.

The attack worked through indirect prompt injection. Rather than instructing the agent directly, the researchers hid a malicious command inside an email. When the user asked Manus to check their messages, the agent read the contents of the email and treated them as instructions.

In an initial test, Manus actually detected the malicious command and flagged it. The researchers then used JavaScript obfuscation to disguise the payload. Manus decoded and executed the hidden code and only generated its security warning afterward — a detail the researchers treat as the key finding. The system could identify suspicious activity, but the warning came after the agent had already acted.

With a reverse shell established, Salt Labs said it was able to find credentials and tokens associated with services connected to the user's Manus account. In a real attack, that access could have reached email, cloud storage or code repositories. The attack required no stolen password, no malicious link and no extra action from the victim beyond asking Manus to check their email.

Salt Labs reported the issue to Manus but said it received no response, so the researchers submitted it through Meta's bug bounty program. Meta confirmed and addressed the issue, and later attempts by Salt Labs to reproduce the attack were unsuccessful. The research was conducted earlier this year, while Meta was preparing to acquire Manus; that transaction did not proceed and the companies remain separate.

Yaniv Balmas, Head of Research at Salt Security, framed the lesson in broader terms: guardrails are an important part of any agentic system that handles untrusted input, but 'are often simply not enough', and builders should rely on layered defenses rather than trusting guardrails to provide all the protection.

The episode points to a structural problem with autonomous agents: detection alone is not a defense if the agent can act before a person can intervene. As more assistants gain the ability to read email, browse files and call connected services, the window between 'detected' and 'executed' is exactly where the risk now lives.