One email was enough to hijack an AI agent: what the Manus research means for your inbox

On October 1, 2026, Salt Labs reported that they hijacked the Manus AI agent with a single email. Hidden instructions inside an ordinary message led to code running in the agent’s sandbox and access to the email, cloud storage, and code repository accounts the user had connected. The vulnerability has since been fixed and is no longer exploitable, according to Salt Labs.

This article explains what happened, why it matters, and what controls can limit the damage from similar attacks.

What did the researchers find?

Salt Labs chose to test Manus because of its Gmail integration. When a user connects Gmail, Manus can read, search, and reply to emails. The researchers sent an email containing hidden instructions to a test account connected to Manus.

When the user asked Manus to check their inbox, the agent processed the email. The hidden instructions caused it to execute malicious code. From there, the researchers accessed the email, cloud storage, and code accounts the user had connected.

The most significant finding, according to Salt Labs, is not the specific flaw but what it reveals about autonomous systems. Manus’s security guardrail detected the attack, but only after the code had already run. On a system that acts on its own, no human sits between the alert and the action.

What is prompt injection?

Prompt injection is when an attacker inserts instructions into content that an AI agent reads. Because the agent cannot always distinguish between trusted commands and untrusted data, it may follow the injected instructions as if they came from the user.

This can happen through email, documents, web pages, or any content the agent processes. The attack does not require the user to click anything or open a malicious attachment. The content itself contains the instructions.

The term is relatively new, and defenses are still evolving. Traditional security tools like antivirus software are not designed to detect or block prompt injection.

What this means for your business

An agent that reads your inbox should not also hold every key to your business. The Manus vulnerability is fixed, but the pattern applies to any agent with broad access.

Consider a law office where an intake agent reads new inquiries. If that agent also has access to client files, billing systems, and document storage, a malicious email could potentially reach all of it. The same risk exists for a contractor’s bids inbox, an online store’s support inbox, or any business function where agents process incoming messages.

The lesson is not to stop using AI on email. The lesson is to limit what an agent can do with what it reads.

Controls that limit the damage

Treat inbound content as data, not instructions. Design agents so that content they process cannot trigger actions beyond what you explicitly allow.

Separate reading from acting. An agent that monitors email does not need the ability to send email, access files, or run code. Give it read-only access where possible.

Approve before sending or paying. Any action that affects customers, moves money, or shares information should require human approval. This applies even if the agent has been reliable.

Keep credentials out of the agent’s workspace. Store sensitive credentials in a vault that the agent cannot access directly. Use permission systems that grant access only for specific, approved actions.

Frequently asked questions

Can antivirus stop prompt injection?

No. Antivirus software looks for known malicious files and code signatures. Prompt injection works by inserting instructions into ordinary text. There is no malicious file to detect. Defenses require AI-specific controls, not traditional endpoint security.

Should I stop using AI on email?

No. Email is one of the highest-value applications for AI agents because of its volume and repetitive nature. The answer is to scope what the agent can access and what actions it can take. An agent that reads and summarizes is lower risk than one that reads, writes, and executes.

Is this vulnerability still exploitable?

Salt Labs states that the flaw has been resolved and is no longer exploitable. The value of the research is the lesson it teaches about agent architecture, not an ongoing threat to Manus users specifically.

Assess your email workflows

If email is a key workflow you are considering for automation, take the AI readiness quiz to see how it scores. Then the Agent Opportunity Audit maps which data an email agent would touch and what controls to implement. For more on email access specifically, see our guide to AI agent email access.