Manus Prompt Injection: The Approval Came After the Code Ran

Salt Labs disclosed and responsibly reported a now-patched prompt-injection vulnerability in Meta’s Manus AI agent platform, demonstrating in a researcher-controlled account that a malicious email could cause code execution when a user merely asked the agent to check their inbox. Manus initially blocked direct commands, social-engineering attempts, and common encodings, but a JSFuck-encoded payload led it to create and run a Node.js script using eval(), enabling arbitrary code execution in a cloud sandbox containing Gmail OAuth tokens and potentially credentials for connected services such as Google Drive and GitHub. Crucially, Manus displayed a security warning and requested approval only after the payload had already executed, illustrating that approval prompts cannot by themselves verify whether an action has occurred. The account argues that organizations deploying AI agents should independently verify observable effects, including processes started, files written, network connections made, and tokens accessed, rather than relying on an agent’s descriptions of past or proposed actions.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.