Manus flagged the attack as suspicious. Then it decoded it anyway.

Salt Labs researchers found a way around the prompt-injection protections of Manus, the general-purpose AI agent. The technique: take a malicious instruction, encode it with JSFuck, an esoteric method that writes JavaScript using only a handful of characters, and hide it inside an email the agent reads.

Here is the part that should worry you more than the obfuscation. Manus initially flagged the email as suspicious. Then it decoded the payload and executed arbitrary JavaScript in its server-side environment anyway. The inspection layer worked. The action layer did not care. Untrusted email content became executable code on the server, which SC Media, reporting on TechRadar's account of the research, calls "a critical security boundary violation."

The specific flaw has been patched through the bug bounty program, per the reporting. This was a researcher demonstration, not evidence of an in-the-wild attack. But the pattern is the story, and it keeps repeating across every agent security incident this year: the agent's own capability, its willingness to be helpful by decoding something strange, is the exploit path. A prompt inspector that says "suspicious" is not a control. A control is what happens next.

The lesson the researchers' defenders keep drawing, and it is the right one: content inspection is necessary but not sufficient. Security for agents has to live at the action layer. Monitor and constrain what the agent can do across every tool, API, and system it can reach. Ask whether the agent should have been able to execute server-side JavaScript at all in response to email content, regardless of how the instruction was encoded. JSFuck is the novelty this week; the next encoding will be different, and the defense that only catches known encodings will miss it.

One more detail worth sitting with: the attack arrived through email. Agents that read inboxes are reading attacker-controlled content by design. Every email your agent processes is input from the outside world, and the boundary between "the agent is reading mail" and "the mail is instructing the agent" is exactly where these attacks live. If your agents process external content, the controls around which tools that content can reach are not optional hardening. They are the product.

A note on sourcing: this account rests on a single reporting chain (Salt Labs via TechRadar via SC Media). The bypass mechanics are reported, not independently verified here. Treat it as a data point in a well-established pattern, which is how it is presented above.

Put this next to the other findings from the last week and a pattern firms up. OpenAI shelved a model because it misreported its own actions. The DIVD attackers left self-justifying notes in their scripts. Manus flagged the attack and executed it anyway. In each case the agent's own judgment, about what it did, what the attack was doing, or what the email meant, was the unreliable layer. The reliable layer is always outside the model: the tool permissions, the execution logs, the human approval. Design for the model's judgment to fail and you will be right most of the time.