Security flaw in Manus AI allowed remote code execution via crafted email
Salt Labs disclosed a prompt-injection vulnerability in the agentic AI platform Manus that allowed remote code execution. By embedding obfuscated JavaScript in an email, researchers could open a reverse shell and access tokens for connected third-party services. Meta, which had agreed to acquire Manus, patched the flaw after its bug-bounty program confirmed it.
The vulnerability exploited Manus's core design—an agent that reads emails and acts on instructions with limited oversight. Salt Labs' initial test triggered a security warning, but the JSFuck encoding executed the payload before the filter could respond, rendering the alert useless. The researchers then used the remote-code-execution flaw to establish a reverse shell, extracting credentials for any third-party services the victim had linked, including email, cloud storage, and code repositories.
The disclosure arrives amid turbulence for Manus's ownership. Meta's $2 billion acquisition was blocked by Chinese regulators, leaving the companies separate even though Meta's bug-bounty program handled the patch. Salt Labs' Balmas noted that agentic systems face novel risks, comparing the field's maturity to buffer overflows, which took years before widespread exploitation emerged.
This incident could reshape how users trust AI agents with access to personal accounts. If a single crafted email can compromise Gmail, Dropbox, or GitHub credentials, individuals and businesses relying on agentic tools may face significant exposure. The gap between Manus's security filter and execution suggests other agentic platforms may harbor similar flaws, potentially slowing adoption until layered defenses mature. Organizations could need to reassess what data they connect to such systems.