One Email Hijacked an AI Agent: Salt Labs' Manus Research Explained

What's the minimum an attacker needs to take over someone's AI agent? According to new research from Salt Labs, the answer for the Manus agent platform was a single email, plus the victim asking their agent to check their inbox. No stolen password and no clicked link.

The specific flaw has been fixed. The pattern behind it hasn't gone away, and it applies to any AI agent you connect to your email.

The setup

Manus is an AI agent platform that can act on your behalf through integrations: connect Gmail, Google Drive or GitHub, and you can ask it to do real work across them. In Salt Labs' write-up, How We Hijacked an AI Agent With a Single Email (1 October 2026), the researchers explain that when a user asks for a Gmail task, Manus spins up a dedicated cloud sandbox for that user and runs the work there, using the user's authorised Gmail access token.

That's a sensible design. But it raises an obvious question: what happens if content from a stranger makes it into that sandbox and gets treated as instructions? Email is the perfect delivery channel, since anyone can send you one.

How the attack worked

Salt Labs describes a step-by-step process:

1. Plain prompt injection didn't work. Emails that told Manus to run shell commands, or claimed to come from its developer, were caught. The agent showed a security warning and asked the user for approval.
2. But the agent was clearly trying to follow the email. The researchers' key observation was that Manus treated email content as instructions, not passive data. It was only the guardrail that stopped it.
3. Common encodings were caught too. Base64 and other obfuscation attempts were detected and blocked.
4. An obscure one wasn't. The researchers encoded a payload with JSFuck, an esoteric JavaScript obfuscation that uses only a handful of characters. Asked to "decode" it, Manus ran it through Node.js, and decoding JSFuck that way means executing it.
5. From code execution to a reverse shell. With that primitive, they escalated to a reverse shell inside the victim's sandbox.

Inside the sandbox they found the victim's Gmail OAuth token and, when other services were connected, credentials for things like Google Drive and GitHub exposed through environment variables. That's the jump from "agent misbehaved" to "attacker can reach your connected accounts".

The detail Salt Labs stresses most: Manus's guardrail did detect the JSFuck payload, but only after it had already run. On a system that acts autonomously, a warning that fires after execution protects nobody.

Salt Labs says it reported the issue through Meta's bug bounty program, and that the flaw has since been resolved and is no longer exploitable.

Why it matters beyond Manus

This is the classic shape of indirect prompt injection: an agent that reads untrusted input (email, web pages, documents) and holds the power to act. Salt Labs' conclusion is that guardrails which inspect prompts are "necessary but not sufficient". You also need limits on what the agent can actually do and reach.

A few lessons generalise well:

• Blocklists lose. Filtering known-bad encodings caught Base64 and missed JSFuck. Attackers only need to find the one you didn't think of.
• Detection has to come before execution. Approval prompts only help if they sit in front of the action.
• Secrets in the runtime are the prize. Tokens in environment variables are convenient, and anything that gets code execution can read them. It's the same reason my guide to Docker in production recommends scoped secrets over sprawling env files.

Connecting an AI agent to your inbox safely

If you use any agent with email access, from any vendor:

1. Connect only what you need. If the job is summarising email, the agent doesn't also need GitHub and Drive. Every extra connector is something an attacker can reach.
2. Prefer read-only scopes where the provider offers them, and avoid giving agents permission to send, delete or forward unless you need it.
3. Keep a human in front of risky actions. Configure agents to ask before sending messages, running code or moving files, and read the prompt before approving.
4. Treat every email as untrusted input, especially ones that ask the agent to "decode", "run" or "process" something.
5. Review and revoke access regularly. In your Google account, check Security > Your connections to third-party apps & services and remove anything you no longer use.

Watch the 60-second version

This story is covered on Riff's AI Headlines, a YouTube channel for fast, sourced AI and cybersecurity news. Subscribe to Riff's AI Headlines on YouTube for more stories like this.