Cases › security breach › LR-2026-0123
Indirect prompt injection in Manus AI agent leads to reverse shell and credential exposure
Whose AI: Manussecurity breach
Severity moderate: Other parties' data or systems were touched, and a source states how far it reached. Credentials and tokens for services connected to the user's Manus account were reached, a bounded scope stated.
Earliest source we hold 2026-10-04
Salt Labs researchers found that a malicious email could hijack the Manus AI agent via indirect prompt injection. In an initial test Manus detected and flagged the malicious command, but after researchers disguised it with JavaScript obfuscation, Manus decoded and executed the hidden code and only then generated a security warning. The researchers established a reverse shell and found credentials and tokens for services connected to the user's Manus account. Salt Labs reported the issue to Manus with no response, then submitted it through Meta's bug bounty program; Meta confirmed and addressed it, and reproduction attempts later failed.
Risk grouping: AI attacked
| Who caused it | A person or organisation “The attack relied on indirect prompt injection: instead of giving the AI agent a malicious instruction directly, researchers placed one inside an email.” source |
|---|---|
| Intended or not | Intended “The attack relied on indirect prompt injection: instead of giving the AI agent a malicious instruction directly, researchers placed one inside an email.” source |
| Before or after release | After release “When the user asked Manus to check their messages, the agent interpreted the contents of the email as instructions.” source |
| The AI's part | Attacked “When the user asked Manus to check their messages, the agent interpreted the contents of the email as instructions.” source |
The story
1 · What it was doingManus, a general-purpose agentic AI platform, was asked by a user to check their email. It had access to services connected to the user's Manus account, including email, cloud storage and code repositories.
2 · What went wrongA malicious email carried an indirect prompt injection. Manus decoded and executed the hidden JavaScript code, crossing the boundary between reading email content and treating it as instructions, and generated its security warning only afterward.
3 · What it reached or didThe researchers established a reverse shell and found credentials and tokens for services connected to the user's Manus account, potentially reaching email, cloud storage or code repositories.
4 · How it was caughtIn an initial test Manus itself detected and flagged the malicious command, but after obfuscation it executed the code and warned only afterward. Salt Labs researchers conducted the tests.
5 · What was doneSalt Labs reported the issue to Manus with no response, then submitted it through Meta's bug bounty program. Meta confirmed and addressed the issue, and later reproduction attempts failed.
What the sources state
- What set it off hidden instructions in its input
Show every field, with its source and grade
The AI system
Model
Manus
C one secondary source states it
Tools it was given
email, cloud storage, code repositories
C one secondary source states it
What it was allowed to do
Connected services tied to the user's Manus account, including email, cloud storage and code repositories.
C one secondary source states it
Safeguards in place
output classifier
C one secondary source states it
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
How it was connected
agentic with tools
D inferred by us from the described behaviour, reason shown
What it was for
A general-purpose agentic AI platform that can perform tasks such as research, data analysis and software development.
C one secondary source states it
State of its safeguards
Detection and flagging of the malicious command was active, but the warning was generated only after the agent had already executed the hidden code.
C one secondary source states it
Meant for live use
yes
D inferred by us from the described behaviour, reason shown
What happened
Earliest source we hold
2026-10-04
A the date the source itself carries
What set it off
hidden instructions in its input
C one secondary source states it
Who caught it
automated monitoring
C one secondary source states it
Themes
prompt injection, agentic AI, credential exposure, reverse shell, post hoc warning
C one secondary source states it
Near miss
yes, no harm happened
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
Where its input came from
An email placed in the user's inbox, read by the agent when the user asked Manus to check their messages.
C one secondary source states it
What was done
Meta confirmed and addressed the issue, and later attempts by Salt Labs to reproduce the attack were unsuccessful.
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
What it did
The agent interpreted instructions embedded in an email as commands and executed hidden JavaScript code, establishing a reverse shell and reaching credentials and tokens for connected services.
C one secondary source states it
Impact
Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
others' security
C one secondary source states it
Who was affected
Credentials and tokens associated with services connected to the user's Manus account, potentially including email, cloud storage or code repositories.
C one secondary source states it
Kinds of data exposed
credentials
C one secondary source states it
Why this severity
Other parties' data or systems were touched, and a source states how far it reached. Credentials and tokens for services connected to the user's Manus account were reached, a bounded scope stated.
D inferred by us from the described behaviour, reason shown
Context
Industry
Information
D inferred by us from the described behaviour, reason shown
LR-2026-0123 · version 3 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON