Salt Labs tricked the Manus agent platform with instructions hidden in an email, bypassed its guardrails in JSFuck, and retrieved access tokens from connected third-party applications.
On September 24, 2026, Salt Labs researchers released an attack on Manus, a stand-alone agent platform that recently sought funds on a $4 billion valuation. The principle is to drag instructions into content that the agent will read on its own — here an email — rather than direct them to the agent. This is the classic pattern of indirect quick injection, but this time it leads to a code execution on the victim's machine.
Manus blocked the execution requests in plain language in an incoming message. The researchers encoded their load in JSFuck, a technique that rewrites JavaScript only with symbols: the execution started before the security warning appeared on the screen. From there, they opened a remote interpreter, then retrieved the identifiers and tokens of third party services connected to the agent — courier, storage, code repository.
The report did not receive a reply from Manus; Meta's bug bonus program has sorted, confirmed and corrected the flaw. The episode illustrates a now recurring mechanics: what the agent has as access rights becomes, in the event of a successful injection, what the attacker has.
Read the full article on the original source
Go to the source →