Salt Labs Research: A Single Email Could Hijack an AI Agent and Reach a User's Connected Accounts

Research into the Manus platform shows that agentic security controls can detect an attack yet fail to stop it before an autonomous system acts

PALO ALTO, Calif., Oct. 1, 2026/PRNewswire/ -- Salt Security, the leader in agentic and API security, today published new Salt Labs research, revealing how a single malicious email could have hijacked the Manus agentic AI platform and exposed accounts connected by the user. The vulnerability was disclosed responsibly and has since been resolved; it is no longer exploitable. Manus is a general-purpose agentic AI platform that can independently carry out multi-step tasks, such as conducting research, analyzing data, creating content and developing software. It is used by individuals and business teams seeking to automate work through natural-language instructions.

The research highlights a security challenge surrounding agentic AI whereby a control may detect malicious activity yet fail to prevent it, because an autonomous agent can complete the action before a human has an opportunity to intervene.

How the attack works

Manus can connect to services including email, cloud storage and code repositories. This connectivity is central to its usefulness, but it also expands the potential attack surface.

Salt Labs researchers found that Manus could interpret the contents of an incoming email as instructions, a technique known as indirect prompt injection. When researchers sent a test user an email containing a direct command, Manus flagged it, demonstrating that its guardrails could recognize an obvious malicious instruction.

The researchers then used an obscure JavaScript obfuscation technique to disguise the command, one of several methods designed to evade detection. Manus decoded and executed the hidden code. Although the platform generated a security warning, it did so only after the code had already run.

The researchers were then able to establish a reverse shell within the environment and locate credentials and tokens associated with third-party services connected by the user. In a real-world attack, this could allow an adversary to reach connected email, cloud storage and code repository accounts.

The attack chain required only two events: the malicious email arriving in the victim's inbox, and the user asking Manus to check their messages. It did not require a stolen password, a clicked link or any further action by the victim.

Why the findings matter beyond Manus

The significance of the research extends beyond the specific vulnerability, which has since been addressed. It demonstrates that detection alone may provide little protection when an autonomous system can act before an alert reaches a human.

In a traditional environment, a security alert can give a person time to investigate and intervene. With an autonomous agent, the action and its consequences may occur before that intervention is possible. A control that identifies malicious behavior only after execution has therefore failed to prevent the attack.

This has direct implications for enterprises deploying AI agents. Guardrails that inspect prompts and model behavior remain an important part of the security architecture, but they cannot provide complete protection on their own. Security controls must also govern and monitor what an agent does across the tools, APIs, data and systems it can access.

"The agentic domain is relatively new, and the industry is still learning how to use it correctly, and so are attackers," said Yaniv Balmas, Head of Research at Salt Security. "Guardrails are an important part of any agentic system that handles untrusted input, but they are often simply not enough. Anyone designing an agentic system should build robust, layered defenses rather than trusting guardrails to provide all the protection, exactly as we learned to do with traditional services. As agentic adoption grows, I have no doubt this will become one of the most common attack vectors we see."

Disclosure

The research was conducted earlier this year. Salt Labs reported the issue to Manus but received no response. The researchers subsequently submitted the vulnerability through Meta's bug bounty program. Meta triaged, confirmed and addressed the issue, and later attempts by Salt Labs to reproduce the attack were unsuccessful, indicating that it had been remediated. Meta had been preparing to acquire Manus during this period. The transaction did not proceed, and the companies remain separate.

Learn more

Full technical details are available on the Salt Labs blog, alongside a video demonstration.

About Salt Security

Salt Security is the leader in agentic and API security, protecting the world's most innovative enterprises from AI agent and API attacks. The Salt Security Agentic Security Platform discovers the agents, MCP servers, and APIs operating in an environment, governs the connections and permissions between them, monitors agent behavior at runtime, and eliminates vulnerabilities before they reach production. Salt Security was founded in 2016 and is backed by Sequoia Capital, S Capital, Tenaya Capital, Salesforce Ventures, Advent International, and other leading investors. For more information, visit salt.security.

Media Contact

Dr. Karl Bateson - [email protected]

SOURCE Salt Security