# The Manus Warning Fired After the Mail Had Already Run. > Salt Labs published the full Manus account on 1 October 2026. Reading mail could run untrusted email in that user's sandbox before the warning. A plain shell instruction was stopped. An obfuscated script was not. The sandbox held the Gmail token and any connected Drive or GitHub token. Meta had fixed it. Salt's retest failed. No build is named. Source: https://hackerlogs.com/blog/manus-warning-after-the-run Published: 2026-10-01 ## Key takeaways - The primary is Salt Labs on 1 October. Dark Reading had the exclusive on 24 September. The fix was already claimed. The full post is the operator record. - A direct shell instruction in email was held for approval. An uncommon JavaScript obfuscation ran in the sandbox first. The warning came after that run. - The sandbox held the user's Gmail OAuth token through the Gmail MCP. Drive and GitHub tokens were present when those accounts were connected. - Salt says Manus did not answer the report. Meta's bug bounty triaged it and fixed it. A later Salt attempt failed. No build number is published. - Rotate connected tokens you cannot date after the fix. A warning that fires after the tool call is not a block. Salt Labs published the full account on 1 October. The primary is [How We Hijacked an AI Agent With a Single Email](https://salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email). A person asked Manus to read mail. Untrusted email became code inside that person's cloud sandbox before the security warning. The Gmail OAuth token was already there. Drive and GitHub tokens were there when those accounts were connected. [Dark Reading](https://www.darkreading.com/application-security/prompt-injection-bug-agentic-ai-app-manus) had the exclusive on 24 September. Meta's fix was already claimed then. The 1 October post is the operator record, and it still has no build number. Hacker News on 1 October led with Pi 1.0, a Cloudflare decision-model launch, and a 2025 OpenID paper on agent identity. US X trends were football, a cosmetics tag, and a sneaker ticker. None of those is this control. Indirect injection from inbox to a sandbox that already holds connected-account tokens. High because the token is the blast radius, not because Salt says the Manus bug is still open. Three panels for the Manus inbox failure: untrusted mail ran before the warning, a seven-day gap from the 24 September exclusive to the 1 October write-up with no build number, and the operator move to rotate tokens and fail closed. ## What Salt Labs actually showed. Manus runs a user's task in a cloud sandbox. For Gmail, Salt says that sandbox calls a Gmail MCP with the user's OAuth token. The user in the test only asked the agent to show recent mail. The attacker only had to have a message waiting in that inbox. A direct instruction to run a shell command was caught. Manus stopped, showed a warning, and asked for approval. Salt's reading of that stop is the important half. The agent had already treated the email as instructions, not as text to quote. Ordinary encodings were caught the same way: decode, then block. The miss was an uncommon JavaScript obfuscation, which Salt Labs and Dark Reading both name. The agent ran that script in the sandbox. The warning for it arrived after the run. Salt then showed the same path could reach the tokens stored for the integration. This brief does not repeat the script. The press release the same day is narrower and consistent. The chain needed two events: the message in the inbox, and the user asking Manus to check mail. No stolen password. No clicked link. Salt says the research was earlier this year, that a report to Manus got no response, and that Meta's bug bounty triaged, confirmed, and fixed it. A later attempt failed. Meta and Manus remain separate companies. A purchase that was being prepared did not go through. > On the plain shell instruction, the warning was a stop. On the obfuscated script, Salt says the warning came after execution. A control that describes an action the agent already took is a log line. It is not a block. ## The fix clock and the impact clock. The fix clock is Meta's patch, and it is undated. [Dark Reading](https://www.darkreading.com/application-security/prompt-injection-bug-agentic-ai-app-manus) on 24 September already said Meta had patched the issue. Salt's [1 October post](https://salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email) and the [same-day release](https://www.prnewswire.com/news-releases/salt-labs-research-a-single-email-could-hijack-an-ai-agent-and-reach-a-users-connected-accounts-302895317.html) add that a later reproduction failed. Neither page prints a build, a changelog, or the hour the patch shipped. Seven days is the gap between the exclusive and the full write-up. It is not the gap between bug and fix. That earlier gap is unpublished. The impact clock is the token. Salt says the sandbox held the Gmail OAuth token for the connected user, and that Drive and GitHub credentials were in the environment when those services were connected. Closing the bug does not expire a token that was already in that process. Salt does not say those tokens were used outside the lab. It also does not give you a timestamp that proves yours was minted after the fix. > If a Manus user had Gmail, Drive, or GitHub connected while this path was open, treat those tokens as exposed unless you can date them after Meta's fix. The public proof the fix existed is the 24 September exclusive. There is still no build to pin. ## What this is not. It is not a claim that Manus is still exploitable. Salt says the later attempt failed. Do not brief it as an open bug. Do not brief the missing build as proof the fix is fictional. It is not a sandbox escape onto Manus's provider. Salt says a user inside their own sandbox is not the boundary they crossed. An attacker reaching someone else's sandbox through mail is the boundary. Salt leaves escape from that sandbox for later research. It is not a stolen password or a phishing click. The user asked the agent to read mail. That request is the intended product path. It is also not evidence of a named victim outside the lab. Salt's account is a controlled test on a connected inbox. Absence of a named customer breach is not a reason to skip rotation if those tokens were present while the path was open. ## What to do. 1. If Gmail, Drive, or GitHub was connected to Manus before you can prove Meta's fix, rotate those tokens and revoke the old grants at the provider. Installing nothing new on your side expires nothing that already left. 2. Do not accept a post-run warning as the control. The tool call from untrusted mail has to fail before it runs. A dialog after the script is a record of the miss. 3. Keep the OAuth token out of the sandbox that reads mail. Inject it only for the named API host, for that call, from a broker the mail content cannot read back. 4. Test the action, not the string. Salt says a plain shell instruction and ordinary encodings were stopped, and one uncommon obfuscation was not. A filter that only catches the obvious instruction will pass the next encoding. 5. Ask who answers a vulnerability report before you connect a mailbox. Salt says Manus did not answer, and the fix arrived through Meta's bounty while a purchase was being prepared. The two companies stayed separate. The reply path is part of the control. The fix clock stopped, by Salt's account, before the 24 September exclusive, on a build nobody has numbered. The impact clock is any connected token you cannot place after that fix. The 1 October post is the day the order of operations became the primary, not the day the bug closed. ## Sources - [How We Hijacked an AI Agent With a Single Email](https://salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email) (2026-10-01) - [Salt Labs Research: A Single Email Could Hijack an AI Agent and Reach a User's Connected Accounts](https://www.prnewswire.com/news-releases/salt-labs-research-a-single-email-could-hijack-an-ai-agent-and-reach-a-users-connected-accounts-302895317.html) (2026-10-01) - [Prompt-Injection Bug Hits $4B Agentic AI App 'Manus'](https://www.darkreading.com/application-security/prompt-injection-bug-agentic-ai-app-manus) (2026-09-24) - [When a security guardrail detects the attack and still can't stop it](https://salt.security/blog/when-a-security-guardrail-detects-the-attack-and-still-cant-stop-it) (2026-10-01)