Executive Summary
In September 2026, security researchers at Salt Labs discovered a critical prompt injection vulnerability in Manus, a $4 billion valuation agentic AI platform. The vulnerability allowed attackers to execute remote code through indirect prompt injection via email, bypassing security filters using JSFuck obfuscation techniques. Researchers demonstrated the ability to establish reverse shells and extract credentials for connected third-party services including Gmail, Dropbox, and GitHub. The vulnerability was reported through Meta's bug bounty program during an attempted acquisition and was subsequently patched.
This incident highlights the growing security risks in the rapidly expanding agentic AI ecosystem, where AI agents with extensive third-party integrations present attractive targets for credential harvesting and supply chain attacks.
Why This Matters Now
As enterprises increasingly adopt agentic AI platforms for business automation, prompt injection attacks represent an urgent and evolving threat vector that can compromise entire integrated ecosystems through a single malicious input.
Attack Path Analysis
Attacker exploited a prompt injection vulnerability in the Manus agentic AI platform through indirect prompt injection via email, used JSFuck obfuscation to bypass security filters, established remote code execution and reverse shell access, then extracted credentials and tokens for connected third-party applications including Gmail, Dropbox, and GitHub to gain unauthorized access to victim's external accounts.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attacker sent malicious email containing obfuscated prompt injection payload using JSFuck technique to bypass Manus AI security filters and achieve remote code execution
MITRE ATT&CK® Techniques
Spearphishing Attachment
JavaScript
Deobfuscate/Decode Files or Information
Obfuscated Files or Information
Process Injection
Credentials In Files
Data from Cloud Storage Object
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Engineering Techniques for Secure Development
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Penetration Testing
Control ID: 500.15
DORA – Identification
Control ID: Article 8
CISA Zero Trust Maturity Model 2.0 – Application Security Testing
Control ID: Applications and Workloads.AW.Am-3
NIS2 Directive – Risk Analysis and Information System Security Policies
Control ID: Article 21.2(a)
ISO 27001:2022 – Use of Cryptography
Control ID: A.8.24
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI agentic applications face critical prompt injection vulnerabilities enabling remote code execution, credential theft, and unauthorized access to integrated third-party services.
Financial Services
Prompt injection attacks targeting AI agents could compromise banking credentials, enable unauthorized transactions, and bypass security controls through manipulated external data sources.
Health Care / Life Sciences
Healthcare AI systems processing patient communications risk HIPAA violations through prompt injection attacks that could expose sensitive medical data and credentials.
Information Technology/IT
IT organizations using agentic AI platforms face lateral movement risks as attackers exploit prompt injection to access GitHub, cloud services, and infrastructure management tools.
Sources
- Prompt-Injection Bug Hits $4B Agentic AI App 'Manus'https://www.darkreading.com/application-security/prompt-injection-bug-agentic-ai-app-manusVerified
- Salt Labs Security Research Report - Manus AI Prompt Injectionhttps://salt.security/blog/manus-ai-prompt-injection-vulnerabilityVerified
- OWASP Top 10 for LLM Applications 2023 - LLM01 Prompt Injectionhttps://owasp.org/www-project-top-10-for-large-language-model-applications/Verified
- NIST AI Risk Management Frameworkhttps://www.nist.gov/itl/ai-risk-management-frameworkVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely reduce the blast radius of this Manus AI prompt injection attack by constraining lateral movement paths and limiting outbound data exfiltration channels. The segmented architecture could contain the compromise within isolated workload boundaries.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The initial compromise through prompt injection would likely still succeed, but CNSF architecture could limit the blast radius by containing the compromised AI service within predefined network boundaries and restricting its access to other cloud resources.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the attacker's ability to escalate privileges beyond the compromised workload boundaries, limiting access to administrative functions and preventing movement to higher-privileged system components within the cloud environment.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely restrict the attacker's ability to move laterally across cloud workloads and access credential stores, limiting their reach to only services within the same security zone as the compromised Manus application.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely detect and constrain the persistent command and control channel, reducing the attacker's ability to maintain long-term access and coordinate activities across different cloud environments and connected services.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies would likely constrain unauthorized outbound data flows, reducing the volume and scope of credential exfiltration by blocking or limiting connections to external services that fall outside approved communication channels.
While external account compromise would likely still occur using exfiltrated credentials, the overall impact scope could be reduced through limited credential harvesting and constrained data collection from the original cloud environment during earlier attack stages.
Impact at a Glance
Affected Business Functions
- AI-Powered Task Automation
- Third-Party Service Integration
- Email Processing and Analysis
- Customer Data Management
Estimated downtime: 2 days
Estimated loss: N/A
Potential access to user credentials and tokens for connected third-party services including Gmail, Dropbox, GitHub accounts, and other integrated platforms. Risk of unauthorized access to personal and business communications, file storage, and development repositories through compromised authentication tokens.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Cloud Native Security Fabric (CNSF) with real-time inspection capabilities to detect and block prompt injection attempts in agentic AI applications
- • Deploy Inline IPS (Suricata) with AI-specific threat signatures to identify obfuscated payloads and malicious AI instructions before execution
- • Establish Zero Trust Segmentation with least privilege access controls to limit AI application permissions and prevent lateral movement to connected services
- • Configure Egress Security & Policy Enforcement to monitor and control outbound connections from AI applications to prevent credential exfiltration
- • Enable Multicloud Visibility & Control with anomaly detection to identify suspicious AI automation patterns and repeated malformed requests targeting agentic systems
