This popular AI agent could be hacked by a single email — with potentially disastrous consequences

Security researchers from Salt Labs have discovered a method to circumvent Manus' prompt-injection protections, enabling code execution through JSFuck obfuscation. The flaw, which was subsequently patched, underscores the risks posed by AI agents with extensive third-party access. Although this specific technique was eventually addressed, Salt Labs suggests that others may exist, just as effective.

Prompt injection attacks, which have plagued AI agents since their inception, occur when an AI misinterprets a user's prompt along with any embedded instructions within the data being analyzed. These attacks become particularly dangerous when AI agents are linked to third-party services like email, web browsers, messaging apps, cloud storage, and calendars.

A recent report by Menlo reveals that consumers are increasingly entrusting AI agents with sensitive applications such as health apps and financial accounts. Salt Labs tested Manus' integration with Gmail, sending an email harboring a hidden prompt. While Manus recognized the prompt as malicious and alerted the user, the AI agent still proceeded to execute the instructions, only being halted by the security mechanism.

The researchers then turned to JSFuck, an uncommon JavaScript obfuscation technique that uses a limited set of characters and is rarely employed in modern environments. By encoding a simple payload in JSFuck and including it in an email, the researchers successfully executed arbitrary JavaScript code within Manus' runtime environment.

Despite Manus' notification of the malicious code execution, the issue was deemed irresolvable at that point. Salt Labs, however, remains cautious about the potential for malicious exploitation of AI agents, emphasizing the necessity of comprehensive security measures beyond merely inspecting prompts and model behavior.