Hijacked by injectionPI-0082
In a researcher demo, a hidden email made the Manus agent run attacker code past its prompt-injection guard
Salt Labs reported on Oct. 1, 2026, that the Manus AI agent could be hijacked with a single email. In a test on the researchers' own account, hidden instructions in an ordinary message led Manus, when asked to check the inbox, to decode a small JavaScript payload obfuscated with the JSFuck technique and run it in its cloud sandbox. From there, Salt Labs says, the code could reach the email, cloud storage and code repository accounts connected to Manus. TechRadar reported that a first, plain hidden prompt was stopped by a security mechanism; with the obfuscated payload, Manus's guardrail flagged the activity only after the code had run. Salt Labs says the flaw has been fixed, and TechRadar reported it was disclosed through Meta's bug bounty program. No use outside the research test was reported.
- Harm
- Harm: No harm reportedAdds nothing to the index.
- Control
- Control level 2, Instruction violationReported beside the index; never added to it. Its evidence is not yet eligible, so it cannot set the control floor.
Under review: the facts may change as more is reported. The rating may change; every change is logged below.
Near miss. Harm was plausible but prevented. It is rated only on what actually happened.
Sources
How we know
2 sources · single source. Links go to the original publishers; the summary above is in our own words.
- researchHow We Hijacked an AI Agent With a Single EmailSalt Labs · Oct. 1, 2026salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email
- newsThis popular AI agent could be hacked by a single email — with potentially disastrous consequencesTechRadar · Oct. 2, 2026techradar.com/pro/security/this-popular-ai-agent-could-be-hacked-by-a-single-em…
Why this rating
No harm reported; control failure level 2
Two separate assessments. Only documented harm can count toward the index.
Observed harm
No harm reportedResearcher demonstration on their own test setup; no victims, data exposure or exploitation reported.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Instruction violationThe agent treated untrusted email content as instructions and ran decoded code in its own runtime. It acted inside its permissions, and its injection detector flagged the activity only after execution.
Reported beside the index; never added to it. Its evidence is not yet eligible, so it cannot set the control floor.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
No harm was reported, which is not a finding of safety: this was a researcher test on the researchers' own account, and Salt Labs says the flaw has been fixed. Control level 2, broke an instruction: the agent followed instructions injected in an email and ran code inside its own sandbox and permissions, and nothing shows it reached systems it was not permitted to reach. The guardrail was beaten by the researchers' obfuscation, not by the model, so no bypass mechanism applies, as in PI-0030. Salt Labs' own report, with TechRadar's coverage.
Effect on the index
It does not count toward the Sept. 28 reading
The reading for the week to Sept. 28, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 18 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | 2 Minor | 2 Minor |
| Harms at that level, nposition in the band | 2 | 2 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | — (none breached) |
| Readingrounded down | 25 Minor harm | 25 Minor harm |
Inside the window of 2 weekly readings
| Week to | Reading | Band |
|---|---|---|
| Sept. 28, 2026 | 25 | Minor harm |
| Oct. 5, 2026 | 25 | Minor harm |
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 7, 2026
Added from the desk (item 61).
Cite and share
Use this record
Citation
Paperclip Index. “In a researcher demo, a hidden email made the Manus agent run attacker code past its prompt-injection guard.” Record PI-0082. Reported Sept. 24, 2026; updated Oct. 7, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0082