Your AI agent reads your inbox so you don’t have to. That makes every stranger who can send you an email a potential operator of your agent.

Salt Labs has shown that the agentic AI platform Manus could be hijacked with a single email. The victim only had to ask Manus to check their inbox: no stolen password, no clicked link. Manus handles Gmail tasks inside a dedicated cloud sandbox, using MCP-based tooling and the user’s authorised Gmail token. Plain malicious instructions and Base64-encoded ones were detected and blocked. A payload obfuscated with JSFuck was not: the agent decoded it with Node.js, which executed it, and the security warning only appeared after the code had run. From there the researchers opened a reverse shell and found the Gmail OAuth token, plus credentials and tokens for other connected services such as Google Drive and GitHub, sitting in the sandbox’s environment variables. Dark Reading reports that Manus did not respond to the report, but Meta’s bug bounty programme triaged, confirmed and patched it; Salt Labs says it is no longer exploitable.

The bug is fixed. The architecture lesson is not. This is indirect prompt injection, which OWASP lists as LLM01, the first entry in its Top 10 for LLM applications: the agent treated email content as instructions rather than data. And the guardrail did its job, just too late. On a human-supervised system a warning buys time; on an autonomous one, no person sits between the alert and the action. Detection that fires after execution is a log entry, not a control. Note the blast radius too: the agent’s runtime held tokens for every service the user had connected, so one email reached far beyond the inbox. Don’t assume this stays in the lab. In July, Proofpoint threat researchers reported indirect prompt injection tools being advertised on underground forums from around $150 a month, including generators for emails with hidden white-on-white text, PDFs, and calendar invites that land in a calendar without being accepted.

What security leaders should do:

• Inventory which AI agents and assistants are connected to corporate mailboxes and calendars, including consumer tools employees authorised themselves, and review those OAuth grants.
• Treat every inbound email, attachment and invite as untrusted data for agents. Reading mail must never be able to trigger code execution or tool calls on its own.
• Enforce before execution: require explicit human approval for sends, payments, file sharing and code runs, rather than warnings after the fact.
• Keep long-lived tokens out of agent runtimes. Use short-lived, narrowly scoped grants per integration, so one hijacked task cannot reach every connected account.

An agent that obeys its inbox is only as trustworthy as the least trustworthy person who can email you.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#AISecurity #AgenticAI #EmailSecurity #PromptInjection #CyberSecurity

Sources: Salt Labs · Dark Reading · OWASP GenAI Security Project · Proofpoint