Salt Labs Found a Way to Execute Hidden Code in Manus Through Email

Security researchers at Salt Labs found a way to make Manus execute code hidden in an email, exposing a weakness in how the AI agent handled untrusted content. The technique has since been fixed, according to the report.

Salt Labs tested Manus’ Gmail integration by sending an email with a hidden prompt. Manus identified it as malicious, but the researchers said the agent still interpreted the email’s contents as instructions. A security mechanism stopped the action.

The researchers then tried other approaches, including Base64 encoding, before using JSFuck, an unusual JavaScript obfuscation method. They placed a simple JSFuck-encoded payload in an email. Salt Labs said Manus treated it as content to decode and render, but it executed JavaScript on the server side. The researchers reported that the payload ran successfully.

Manus notified the owner only after the code had executed, according to Salt Labs. The researchers said they disclosed the issue through Meta’s bug bounty program and that it has been resolved and is no longer exploitable.

The report notes that the risk grows when AI agents can access connected services. Menlo’s 2026 consumer AI report says respondents had given agents access to email (36%), web browsers (33%), messaging apps (31%), cloud storage (29%) and calendars (27%). Access to health apps (23%) and financial accounts (20%) was less common.

Salt Labs said safeguards must cover not only prompts and model behavior but also what agents do through the tools, APIs and systems they can reach.