Manus agent ran attacker JavaScript from an email it had already flagged as suspicious

Manus's protections fired first. They flagged the email carrying Salt Labs' hidden prompt as suspicious ^[3][6]. According to SC World, the agent then decoded the JSFuck payload and ran it as arbitrary JavaScript in its server-side environment before its security mechanisms could fully intervene ^[4]. The agent did the decoding itself. It turned the obfuscated text back into working code and then executed it ^[4].

The order of events changes the diagnosis. When a filter misses an encoding, a better signature can fix it. This filter recognized the input, and the payload still ran on the server ^[6][4].

SC World's brief names the researcher, the agent, the encoding and the delivery method ^[1][2][3]. It leaves out disclosure and patch dates, what the server-side environment could reach, any use of the technique outside the research, and any threat actor or campaign. On that record, this is a researcher finding that was handled through Meta's bug bounty program ^[7].

The exposure that remains after the patch applies to agents of this kind generally. SC World places the case within the ongoing risk from AI agents granted broad access to third-party services ^[10]. It also expects creative attack methods beyond JSFuck ^[11]. A rule written for JSFuck covers this payload only, and with a different encoding the filter could again flag the email while the agent still ran the code ^[6][11].

In this chain, the action that mattered was the agent executing server-side JavaScript it had decoded from untrusted mail ^[4]. The control that would have contained it is a limit on what agent-run code can reach, enforced whether or not the input filter raises a flag. The brief's own remedy, monitoring and controlling what the agent does, applies at that same point ^[9].