A research demonstration, with the flaw repaired
Salt Labs published research on October 1 describing how a crafted email could make the Manus AI agent execute code inside a user’s cloud environment. In the researchers’ test, the user only needed to ask the agent to check the inbox. Salt says the vulnerability has been resolved and is no longer exploitable. The report describes controlled testing, not a confirmed campaign against customers.
The warning arrived after execution
According to Salt, an obfuscated payload was processed as executable JavaScript while the agent attempted to decode email content. A security warning appeared after the code had already run. The researchers reported access to the environment’s Gmail integration and associated token, and described risks to other connected services. Those findings concern authority available within that user’s environment; the report does not establish a sandbox escape or a breach of every connected customer.
An inbox task should have an inbox-sized permission set
For a media company evaluating an assistant, our analysis starts with the assignment: collecting interview requests does not inherently require permission to publish stories, modify production code or search every employee’s cloud files. A professional services firm can make the same distinction between summarizing correspondence and acting on client records. These are deployment decisions that can be reviewed before a pilot begins. Create a task inventory listing the information each workflow must read, the changes it may make, and the person accountable for approving those changes. Where a product cannot enforce the intended boundary, narrow the pilot’s data and connected accounts instead of relying on a written instruction alone.
Test the point where a proposed action becomes real
A useful acceptance test should ask what happens when an external message requests an action outside the original assignment. Conduct that test in an authorized environment with synthetic messages and nonproduction accounts. Record the proposed tool action, whether approval was required beforehand, and whether any external effect occurred. A reassuring answer in the chat window is only one observation; the integration’s action history is another. Test the ability to stop the workflow and revoke its access as part of the same exercise. For an MSP, those results can become a concrete customer handover: approved use cases, connected accounts, escalation contacts and the steps for disabling access. This approach makes the risk review specific to the service being deployed, while avoiding the unsupported conclusion that every AI email assistant shares this repaired vulnerability.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
