Security researchers expose vulnerability allowing email-based attacks on autonomous AI systems

Security researchers demonstrated a method to compromise the Manus AI agent through email-based prompt injection attacks, bypassing its built-in safety protections using code obfuscation techniques. The vulnerability allowed malicious instructions hidden in emails to be executed before detection systems could flag suspicious activity, potentially enabling attackers to access sensitive data or manipulate connected accounts. While this particular flaw has been patched, the discovery highlights ongoing risks as AI agents gain broader access to third-party services like email and calendar systems.

Prompt injection attacks exploit a fundamental limitation in how AI systems process information: they cannot reliably distinguish between user instructions and data contained within that data. When an AI agent accesses external services like email or calendar systems, malicious instructions hidden within those communications can be executed as legitimate commands. The Manus vulnerability demonstrated how obfuscation techniques could conceal harmful prompts long enough to bypass initial detection systems, allowing unauthorized actions before safety mechanisms triggered alerts.

The broader concern stems from accelerating adoption patterns. Recent consumer behavior data shows substantial percentages of users granting AI agents direct access to sensitive applications—from email and browsers to financial accounts—to enhance functionality and convenience. This expanding connectivity creates more entry points for potential attacks while AI safety measures continue developing.