The guardrail fired after the code had run

Manus is a general-purpose agentic platform that carries out multi-step tasks and can connect to a user's email, cloud storage and code repositories. Salt Labs researchers found that it could interpret the contents of an incoming email as instructions (the indirect prompt injection that OWASP lists among the top risks for LLM applications).

When the researchers sent a test user an email containing a direct command, Manus flagged it, showing that its guardrails could recognise an obvious malicious instruction. They then disguised the command with an obscure JavaScript obfuscation technique; Dark Reading identifies it as JSFuck, an esoteric method that expresses code in a handful of characters. Manus decoded and executed the hidden code.

The platform generated a security warning, but only after the code had already run. The researchers established a reverse shell inside the environment and located credentials and tokens associated with the third-party services the user had connected. In a real attack, Salt says, that could reach a victim's connected email, cloud storage and code repository accounts.

The attack chain required two things and no more: the malicious email arriving in the victim's inbox, and the user asking Manus to check their messages. It did not need a stolen password, a clicked link or any further action by the victim.

Salt frames the finding as a problem larger than Manus. In a traditional environment a security alert gives a person time to investigate and intervene; with an autonomous agent the action and its consequences can happen before that intervention is possible. A control that identifies malicious behaviour only after execution has not prevented the attack, and the incident is already over.

"Guardrails are an important part of any agentic system that handles untrusted input, but they are often simply not enough," said Yaniv Balmas, Head of Research at Salt Security. "Anyone designing an agentic system should build robust, layered defenses rather than trusting guardrails to provide all the protection, exactly as we learned to do with traditional services."

Salt Labs says the research was conducted earlier this year. It reported the issue to Manus and received no response, then submitted the vulnerability through Meta's bug bounty programme. Salt says Meta triaged, confirmed and addressed the issue, and later attempts by Salt Labs to reproduce the attack were unsuccessful, indicating it had been remediated. Salt reports that Meta had been preparing to acquire Manus during that period; the transaction did not proceed and the companies remain separate.

A note on the date: Salt published this on 1 October 2026, after Dark Reading ran an exclusive on 24 September. The research itself was carried out earlier in 2026, so what is new this week is the publication, not the incident or the fix.