Salt Labs says a single email could hijack an AI agent

Salt Security says new Salt Labs research found a malicious email could have manipulated the Manus agentic AI platform and reached user-connected accounts before a warning could stop it. The finding underscores a broader risk for autonomous AI systems: detection alone may not prevent harm if the agent acts first.

Why it matters: - Salt Labs says the test shows a key weakness in agentic AI security: a system can detect a threat and still fail to stop the action before damage occurs. - The result matters for enterprises connecting AI agents to email, cloud storage and code repositories. - The finding suggests guardrails alone are not enough when an autonomous system can execute tasks without waiting for human approval.

What happened: - Salt Security published new Salt Labs research on the Manus agentic AI platform. - Researchers showed that a single malicious email could have hijacked Manus and exposed accounts connected by the user. - Manus is a general-purpose agentic AI platform that can independently carry out multi-step tasks, including research, data analysis, content creation and software development. - The vulnerability was disclosed responsibly and has been resolved. - The issue is no longer exploitable.

The details: - Manus can connect to services such as email, cloud storage and code repositories. - Researchers found that Manus could interpret an incoming email as instructions, a tactic known as indirect prompt injection. - A direct malicious command in a test email was flagged by Manus, showing the platform could recognize an obvious attack. - Researchers then used a JavaScript obfuscation technique to hide the command. - Manus decoded and executed the hidden code. - The platform generated a security warning only after the code had already run. - Researchers established a reverse shell in the environment. - Researchers located credentials and tokens tied to third-party services connected by the user. - Salt Labs said a real-world attacker could have used that access to reach connected email, cloud storage and code repository accounts. - The attack chain required only two events: the malicious email arriving in the victim’s inbox and the user asking Manus to check messages. - The attack did not require a stolen password, a clicked link or any other victim action.

Between the lines: - Salt Security’s core warning is that detection after execution is too late in autonomous systems. - In a traditional setup, a human can often review an alert before harm spreads. - With an agent that can act instantly across connected tools, the alert may arrive after the damage is done. - The research points to a broader need for controls that monitor and govern what an AI agent can do, not just what it reads. - Yaniv Balmas, head of research at Salt Security, said the agentic space is still new and attackers are still learning how to use it. - Balmas said designers should build layered defenses rather than rely on guardrails alone.

What's next: - Salt Security said the full technical details are available on the Salt Labs blog, along with a video demonstration. - The company says enterprises deploying AI agents should expect security models to evolve as adoption grows. - Salt Security expects agentic systems to become a more common target for attackers.

The bottom line: - A warning that arrives after an AI agent acts is not the same as a control that prevents the attack.