Technology Miraj Islam October 3, 2026 0 Comments

This popular AI agent could be hacked with a single email, with potentially disastrous consequences

Researchers bypassed Manus fast injection protections and achieved code execution via JSFuck obfuscation
The hidden emails were decrypted and executed before Manus flagged suspicious activity.
Bug fixed, highlighting risks of AI agents with extensive third-party access

If you think emailed rapid injection attacks against Manus were a thing of the past, think again.

Security researchers at Salt Labs have found a way to bypass security barriers, and while this particular technique was later fixed, it is likely that there are others that are equally effective.

“Honey, I deployed malware”

Rapid injection attacks are nothing new. They have been around since the early days of AI agents and the premise is very simple. AI cannot distinguish between indications and data to be analyzed. If a user asked an AI agent to summarize an email they received and that email contained a separate message, the AI would execute both.

Too little, too late

For Salt Labs, this raised a question: What if the AI didn’t realize the notice was malicious? Would I still notify the owner or not?

They tried different approaches, including encoding the prompts in Base64 and having the AI agent decode and execute them using Python. They finally struck gold, in the form of JSFuck. They described it as an “unusual method of JavaScript obfuscation” that uses a limited set of characters and as such is “rarely used in modern environments.”

The researchers prepared a simple payload coded in JSFuck that would execute a basic JavaScript statement and included it in the email.

“The intent appeared to be content decoding and rendering. However, this effectively executed arbitrary JavaScript code in a server-side environment,” they said. “The payload was executed successfully and we observed the expected result.”

“At this point, we reached a clear violation of security boundaries: untrusted email content was transformed into executable code and executed within the agent’s execution environment.” Ironically, Manus notified the owner, but only after the malicious code was executed. Too little and too late.

Salt Labs said they responsibly disclosed their findings through Meta’s bug bounty program, and that the issue “has since been resolved and is no longer exploitable.”

However, hidden within the report is a gem of wisdom: if the researchers managed to bypass Manus’ security barriers, it is likely that the criminals will too. Maybe not through JSFuck, but human creativity knows no limits.

“This is the central lesson for any company deploying AI agents: security guardrails that inspect cues and model behavior are necessary but not sufficient. Security has to extend to what an agent actually does across all the tools, APIs, and systems it can access,” Salt Labs concluded.