Salt Labs Hijacks the Manus Agent With a JSFuck-Encoded Email and Reaches Its Connected Gmail, GitHub, and Dropbox Tokens

Manus, the general-purpose agentic AI platform, and the third-party accounts users connect to it

Salt Labs disclosed on September 24, 2026 an indirect prompt injection in Manus delivered through an email the agent was asked to process. Plain malicious instructions were caught by Manus's filter, so the researchers encoded the payload with JSFuck, a JavaScript obfuscation that writes code using only six characters, and the agent executed the hidden instruction before the filter caught up. That produced code execution in the agent's environment, a reverse shell, and access to the credentials and tokens for connected third-party services such as Gmail, GitHub, and Dropbox, turning the agent into a gateway to every account the user had linked. Manus did not respond to the original report; Meta's bug bounty program triaged, confirmed, and patched it. The disclosure landed while Manus was seeking funding at a reported $4 billion valuation after Chinese regulators blocked Meta's planned $2 billion acquisition in April 2026

A content filter placed in front of an agent that can execute code is a race the encoder wins. Once code ran, the agent's sandbox held live OAuth tokens for the user's other services, so one email reached all of them