{"schema_version":"0.10.0","id":"LR-2026-0781","record_version":1,"title":"OPPO Find X10 Manus AI agent email access: indirect prompt injection vulnerability disclosed","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":45.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":2.24,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Tech Times · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Tech Times · subject to change"}]},"sources_hash":"b59747a98aab85b9a7e128d40ea0f8c73b6faf70d1ef7352bf01d7486bc1b30d"},"system":{"model_name":null,"model_version":null,"developer":"Butterfly Effect","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-24","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Manus, an AI agent platform built by Butterfly Effect, can act on a user's behalf with access to resources such as email. On September 24, 2026, Salt Labs published a disclosure of an indirect prompt injection vulnerability. An attacker could send an email containing instructions that the agent processes. The embedded instructions, encoded with JSFuck, were reported to direct the agent to execute attacker-controlled code within its virtual environment. The vulnerability was disclosed through Meta's bug bounty program. Salt Labs confirmed the fix was effective before publication. The sources do not report exploitation in the wild, affected users, or data exposed.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"negligible","severity_because":"Test: no effect beyond the system itself. Fact: the vulnerability was patched and the fix confirmed effective before publication; the source reports no exploitation, affected parties or data loss.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.techtimes.com/articles/329254/20261020/oppo-find-x10-debuts-manus-ai-researchers-exposed-exploit-china-can-compel-agent-email-access.htm","publisher":"Tech Times","date":"2026-10-20","type":"press","title":"OPPO Find X10 Debuts With Manus AI; Researchers Exposed Exploit, China Can Compel Agent Email Access - Tech Times","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","event.date_disclosed":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Manus was built by Butterfly Effect, a Chinese team that also created the Monica browser extension."}],"event.date_disclosed":[{"source_index":0,"quote":"On September 24, 2026 — four days before Manus 2.0 launched — Salt Labs published a Manus prompt injection disclosure covering a critical indirect prompt injection vulnerability."}],"event.incident_class":[{"source_index":0,"quote":"On September 24, 2026 — four days before Manus 2.0 launched — Salt Labs published a Manus prompt injection disclosure covering a critical indirect prompt injection vulnerability."}],"impact.severity":[{"source_index":0,"quote":"Salt Labs confirmed the fix was effective before publication."}],"impact.severity_because":[{"source_index":0,"quote":"Salt Labs confirmed the fix was effective before publication."}],"event.summary":[{"source_index":0,"quote":"The attack worked as follows: an attacker sends a malicious email to a user whose Manus account has been granted email access."},{"source_index":0,"quote":"On September 24, 2026 — four days before Manus 2.0 launched — Salt Labs published a Manus prompt injection disclosure covering a critical indirect prompt injection vulnerability."},{"source_index":0,"quote":"The embedded instructions direct Manus to execute attacker-controlled code within the agent's virtual environment."},{"source_index":0,"quote":"The vulnerability was disclosed through Meta's bug bounty program while Manus was still operationally integrated with Meta's infrastructure."},{"source_index":0,"quote":"Salt Labs confirmed the fix was effective before publication."}]},"notes_on_gaps":"Only one source, a tech publication with opinion content. The source describes a disclosed and patched vulnerability, not a confirmed real-world compromise: no date of occurrence, date of detection, affected user count, data exposed, or confirmed exploitation is stated, so those fields are omitted. Salt Labs' disclosure is treated as the detection method. Judgements made: content filters mapped to C5; the instructions-and-data-channel statement mapped to C1 as missing, although it is a general statement; the patch mapped to J1 as an added control; near_miss set true because the fix preceded publication and no exploitation is reported; severity set to negligible because no effect beyond the system is stated. The article's claims about China's National Intelligence Law, OPPO's ownership, Manus's funding and Meta acquisition are background and are not used as incident facts. Manus's Cue feature is not confirmed as the feature that was exploited. The source does not name the external attacker's identity, so adversarial_actor is omitted. The system's model name and autonomy level are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Tech Times · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"caught","text":"Salt Labs published the vulnerability disclosure on September 24, 2026.","quote":"On September 24, 2026 — four days before Manus 2.0 launched — Salt Labs published a Manus prompt injection disclosure covering a critical indirect prompt injection vulnerability.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.com/articles/329254/20261020/oppo-find-x10-debuts-manus-ai-researchers-exposed-exploit-china-can-compel-agent-email-access.htm"]},"analysis":{"sections":{"timeline":[{"text":"Salt Labs published the Manus prompt injection disclosure.","quote":"On September 24, 2026 — four days before Manus 2.0 launched — Salt Labs published a Manus prompt injection disclosure covering a critical indirect prompt injection vulnerability.","source_index":0,"when":"2026-09-24"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.com/articles/329254/20261020/oppo-find-x10-debuts-manus-ai-researchers-exposed-exploit-china-can-compel-agent-email-access.htm"]}}