Yes. Salt Labs reported that a specially crafted email could make Manus run attacker-controlled code when a user asked the AI agent to check Gmail. The demonstration showed remote code execution inside Manus’s sandbox and potential access to connected-account data; it was a controlled proof of concept, not evidence of a confirmed customer breach. Salt Labs says the vulnerability was resolved.
How could an email control Manus?
The issue was an example of indirect prompt injection: instructions arrive inside material the agent is supposed to read, rather than as a direct request from the user. An email can look like ordinary content to a person while carrying instructions intended to manipulate an AI system that processes it.
As an Amazon Associate I earn from qualifying purchases.
In Salt Labs’ demonstration, the victim had connected Manus to Gmail and asked it to inspect the inbox. The attacker did not need the victim to click a link or run an attachment; the malicious content was processed as part of the email-reading task.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe demonstrated attack chain
- The victim connects Manus to Gmail and asks it to read, search, summarize, or reply to messages.
- An attacker sends an email containing hidden or obfuscated instructions.
- Manus retrieves the message through its Gmail and MCP workflow, then treats its content as instructions rather than untrusted data.
- A direct attempt to issue shell commands triggers a warning. Salt Labs says it bypassed that protection by encoding the instructions with JSFuck, an unusual JavaScript-obfuscation technique.
- Manus invokes a Node.js runtime, runs attacker-controlled JavaScript, and then executes system commands. The warning appeared after the payload had already run.
- Salt Labs demonstrated a reverse-shell connection from the sandbox and found access to Gmail OAuth data. Depending on the user’s configuration, connected Drive or GitHub credentials could also have been exposed.
Salt Labs characterized the victim’s required action as simply asking Manus to check the inbox. That does not mean every email or every Manus session was vulnerable: it describes the tested attack path.
What was demonstrated—and what was not?
The demonstrated result was remote code execution in a controlled sandbox, along with potential access to connected-account data. A proof of concept establishes that the attack path worked under the test conditions; it does not establish that criminals used it against customers or that customer accounts were breached.
Salt Labs said it disclosed the vulnerability responsibly through Meta’s bug-bounty program and that the issue has been resolved. The report does not provide a CVE identifier, a patch version, or the exact fixed build, so those details should not be inferred.
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
Why are email-reading agents exposed to this kind of risk?
Agents are useful partly because they can read external content and then take actions with connected tools. That creates a boundary problem: a message, webpage, document, or repository can contain text that the agent must understand, but should not treat as authority to run code or use an account.
Recommended Free Tools
The Manus test also shows why detecting suspicious language is not enough. A control that catches a plain command but allows an obfuscated form through—and warns only after execution—does not reliably prevent the action. Salt Labs’ conclusion was that “guardrails that inspect prompts and model behavior are necessary but not sufficient.”
The potential impact depends on what the agent can reach. In a 2026 figure quoted by TechRadar, Menlo reported that consumers had given agents access to email (36%), web browsers (33%), messaging apps (31%), cloud storage (29%), and calendars (27%). Access to health apps (23%) and financial accounts (20%) was described as less common. Those figures describe reported consumer access, not the share of users affected by this vulnerability.
How should you assess an AI agent connected to email, Drive, or GitHub?
Before connecting an account, check whether the system enforces these controls. They address the specific failure modes in the Manus demonstration; they are not a claim that every vendor implements them.
Rank #4
| Control to assess | What a safer deployment should do | Why it matters |
|---|---|---|
| Separation of content and instructions | Treat email and other external material as untrusted input, not as authority to override the user’s request or system rules. | A malicious message should not become an executable instruction merely because the agent reads it. |
| Approval before code execution | Require explicit approval before code or system commands run; do not rely on a warning shown after execution. | The tested warning did not stop the payload from running. |
| Sandbox and network egress | Restrict what code can access, including outbound network connections and files or credentials in the runtime environment. | Containment can limit the consequences if an instruction bypasses other defenses. |
| Least privilege and separate credentials | Grant only the account scopes and tools the task needs, and avoid giving a single agent broad access to mail, storage, and code repositories. | Connected permissions determine how much an attacker could reach. |
| Confirmation for consequential actions | Require user confirmation before sending messages, changing or deleting data, or taking other sensitive actions. | Reading content should not silently authorize an external or destructive action. |
| Monitoring and audit trail | Record tool calls and execution activity, and make them reviewable by the user or administrator. | Auditability helps identify unexpected behavior and investigate what an agent actually did. |
What can users do now?
- Check which accounts and permissions are connected to an agent; disconnect integrations that are not needed.
- Prefer narrowly scoped, task-specific access over broad access to an entire mailbox, drive, or repository.
- For sensitive workflows, choose systems that require approval before code execution and before sending, deleting, or changing data.
- Review available activity logs after unexpected behavior, and revoke or rotate connected credentials if you have reason to believe they were exposed.
- Do not assume that an agent is safe from prompt injection because it blocks obvious commands; obfuscated instructions can evade simple content checks.
Does the Manus report mean other AI agents can be hacked by email?
It establishes a demonstrated risk in the reported Manus setup, not a finding that every email-connected agent is vulnerable. The broader design risk applies wherever an agent processes untrusted content and can autonomously call tools: a malicious email or document may influence what the agent does unless instructions, permissions, execution, and approval are separated effectively. Evaluate each product’s controls rather than assuming the Manus fix addresses other systems.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
