Prompt-Injection Bug Hits $4B Agentic AI App 'Manus'

Summary

Researchers at Salt Labs disclosed a prompt-injection vulnerability in Manus, a fast-growing agentic AI application, that allowed them to achieve remote code execution inside a target user's Manus environment. The flaw was demonstrated by the researchers as a proof of concept rather than observed being exploited in the wild.^[0]

By hiding malicious instructions in an email (indirect prompt injection) and obfuscating them with the JSFuck JavaScript technique, researchers bypassed Manus's guardrails, executed a payload, and established a reverse shell that exposed credentials and tokens for third-party services a victim had connected to Manus, such as Gmail, Dropbox, and GitHub. Manus did not respond to the disclosure, but Meta's bug-bounty program triaged, confirmed, and patched the issue.^[0]

Attack chain

1. Indirect prompt injection: An attacker embeds hidden AI instructions in an external data source, such as an email, that Manus reads and processes when a user asks it to summarize or handle their inbox.^[0]
2. Guardrail bypass via obfuscation: After Manus flagged plaintext and various encoded instructions, researchers used the obscure JSFuck JavaScript obfuscation technique to smuggle a payload past the security filter; Manus still generated a warning, but only after the payload had already executed.^[0]
3. Remote code execution and reverse shell: Researchers leveraged an RCE bug to establish a reverse shell inside the Manus app environment.^[0]
4. Credential and token theft: Using the shell, researchers located credentials and tokens for third-party applications connected to Manus (e.g., Gmail, Dropbox, GitHub), enabling access to the victim's email, storage, and coding accounts.^[0]

Disclosure timeline

How it works

Manus interprets data it reads from external sources (such as connected email inboxes) as instructions, not merely as content. This makes it susceptible to indirect prompt injection, where an attacker plants hidden AI instructions in an email that Manus processes on the victim's behalf.^[0]

Manus's guardrails detected plaintext executable instructions and several common encoding/obfuscation tricks, but failed against the JSFuck JavaScript obfuscation technique, which allowed a payload to execute before the security warning fired. The researchers chained this to a remote code execution bug to open a reverse shell and then extracted credentials and tokens for third-party services connected to the victim's Manus account.^[0]

Affected versions and patch status

Key takeaways

• Prompt injection remains a signature vulnerability class for AI apps; while largely researcher-driven so far, experts expect it to become one of the most common attack vectors as agentic AI adoption grows.^[0]
• Agentic AI that both interprets external data and holds credentials for connected third-party services creates a high-value target: a single indirect prompt injection combined with an RCE bug can pivot to email, storage, and code accounts.^[0]
• Obfuscation techniques like JSFuck can defeat AI security filters that catch simpler encodings, underscoring that guardrails must be backed by additional defensive layers.^[0]

Defensive actions

• Do not rely solely on built-in AI guardrails; design robust, layered defenses for agentic systems handling untrusted input.: Salt Labs' research shows guardrails detected many injection attempts but were bypassed by JSFuck obfuscation, and the warning fired only after execution, demonstrating guardrails alone are insufficient.^[0]
• Treat external data ingested by AI agents (such as emails) as untrusted and constrain what actions agents can take on connected third-party accounts.: The exploit abused Manus's interpretation of email content as instructions to reach credentials and tokens for connected services like Gmail, Dropbox, and GitHub.^[0]