{
  "entry": {
    "kind": "vuln",
    "slug": "manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction",
    "name": "manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction",
    "vendor": "Manus cloud agent",
    "description": "Salt Labs published on 1 October 2026 (first reported by Dark Reading on 24 September) that an email alone could hijack a Manus agent. Manus processes Gmail through its own Gmail MCP inside the user's cloud sandbox. Plain and base64-encoded instructions were caught by its guardrail, but a JSFuck-encoded payload with a request to \"decode\" it led the agent to run Node.js on the content, which executed it; the security warning appeared only after the code had already run. Salt escalated to a reverse shell and found the victim's Gmail OAuth token and, through environment variables, tokens for other connected services such as Google Drive and GitHub. The victim only had to ask Manus to read their inbox. Salt got no reply from Manus and reported via Meta's bug bounty, which triaged and fixed it. Separately, CodeAnt AI (Amartya Jha, 19 September) showed that an instruction planted in a shared Manus project ran code in another member's sandbox after they accepted a project invite, exfiltrated environment secrets, and used a static NEKO desktop admin password from them to take over the victim's live remote desktop; reported May 2026, fixed 16 September.",
    "website": "https://salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-10-01",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction",
      "aliases": [
        "ti-116"
      ],
      "title": "Manus: One Email With a JSFuck Payload, or One Shared-Project Instruction, Ran Code in the Victim's Sandbox and Reached Their Connected-Account Tokens",
      "summary": "Salt Labs published on 1 October 2026 (first reported by Dark Reading on 24 September) that an email alone could hijack a Manus agent. Manus processes Gmail through its own Gmail MCP inside the user's cloud sandbox. Plain and base64-encoded instructions were caught by its guardrail, but a JSFuck-encoded payload with a request to \"decode\" it led the agent to run Node.js on the content, which executed it; the security warning appeared only after the code had already run. Salt escalated to a reverse shell and found the victim's Gmail OAuth token and, through environment variables, tokens for other connected services such as Google Drive and GitHub. The victim only had to ask Manus to read their inbox. Salt got no reply from Manus and reported via Meta's bug bounty, which triaged and fixed it. Separately, CodeAnt AI (Amartya Jha, 19 September) showed that an instruction planted in a shared Manus project ran code in another member's sandbox after they accepted a project invite, exfiltrated environment secrets, and used a static NEKO desktop admin password from them to take over the victim's live remote desktop; reported May 2026, fixed 16 September.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Prompt injection",
        "Credential theft"
      ],
      "componentType": "agent",
      "component": {
        "name": "Manus cloud agent",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/manus"
      },
      "affected": [
        {
          "range": "Manus cloud agent (SaaS). Both issues were fixed server-side (CodeAnt finding fixed 16 September 2026; Salt Labs finding resolved before publication). No customer patch; no CVE.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-01",
      "modifiedAt": "2026-10-01",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email"
        }
      ],
      "mitigation": "No client action closes these, since both were fixed server-side, but the exposure window matters: if Manus had Gmail, Google Drive, GitHub or other connectors linked before mid-September, review those accounts for unfamiliar OAuth grants, forwarding rules and repository activity, and revoke and re-issue the Manus connector tokens. Grant Manus only the connectors a task needs and disconnect the rest, treat inbound email and shared projects as untrusted input to any agent with tools, and accept project invites only from known collaborators. More generally, do not count on guardrails that warn after a tool call: put approval before any agent action that executes decoded content or reaches connected-account credentials.",
      "detectedByAnomity": true
    }
  }
}