Researchers Reveal Single Email Can Compromise AI Assistant via Security Flaw

Researchers in security have shown that a lone, specially designed email can hijack the AI‑driven assistant Manus, enabling attackers to execute arbitrary code on the service.

Promoted as a flexible agent that connects to many third‑party services, Manus depends on prompt‑injection defenses to reject harmful commands. The team discovered that inserting a hidden JavaScript payload into the email body—obfuscated via the JSFuck method—allowed them to evade the filters and cause execution before the platform marked the behavior as suspicious.

Their method concealed the malicious prompt within what looked like an ordinary email. After the message was handled, Manus decoded the obfuscated script and interpreted the concealed directives as a valid request, leading to code execution on the host system. The vulnerability came to light when the hidden prompts operated undetected for a short interval, exposing a shortfall in the assistant’s capacity to vet intricate, encoded inputs.

Analysts note that the incident highlights a wider issue: AI agents with broad access to external APIs and user information become lucrative targets when their input‑validation safeguards fall short. Such a compromise could permit data theft, illicit operations on linked services, or even ransomware deployment, depending on what the attacker seeks.

After the finding was reported, Manus’s developers rolled out a fix that strengthens scrutiny of inbound messages and enhances detection of JSFuck‑style obfuscation. The episode acts as a warning to the sector, spurring demands for stricter testing of prompt‑injection protections and increased openness about the security controls governing AI agents with extensive third‑party connectivity.