What happened
Salt Labs researchers disclosed on 2026-09-24 (exclusive via Dark Reading) an indirect prompt-injection vulnerability in Manus, the agentic AI app (post-$4B valuation). Attackers hid instructions in an email Manus would later read; the injection bypassed the app's security filter, let the researchers achieve remote code execution inside a stranger's Manus environment, open a reverse shell, and pull OAuth tokens for whatever third-party accounts (Gmail, Drive, GitHub) the victim had linked. The flaw was resolved through Meta's bug-bounty pipeline after Meta's planned acquisition of Manus was blocked.
Why it matters
This is the canonical 'agentic app as pass-through' compromise: a single crafted email becomes remote code execution inside an AI agent with broad delegated authorizations, converting Manus into a pivot to every connected application. No CVE was assigned, but it demonstrates a real, demonstrable prompt-injection-to-imperative-control path against a widely-used agentic platform.
Attack vector
Indirect prompt injection via email/document content read by the Manus agent, chained with an RCE in the agent runtime to exfiltrate linked-service OAuth tokens.
Affected systems
Manus agentic AI platform (patched via Meta bug-bounty pipeline; no version/CVE published)
Mitigation
Treat all retrieved/emailed content as untrusted; enforce per-action authorization and egress policy on agent tool use; vendor fix delivered via Meta bug-bounty resolution. No public advisory URL yet beyond press.