One Email Was Enough: When a Guardrail Detects the Attack and Still Can't Stop It
Summary
Salt Labs, the research arm of Salt Security, turned the agentic AI platform Manus into a path to remote code execution with a single email.
The victim did not have to click a link, download an attachment, or give up a password. The whole attack needed exactly two events:
An email with hidden instructions arrives in the Gmail account the user connected to Manus.
At some later point, the user asks Manus to check their inbox. From there, the researchers achieved code execution inside Manus's sandbox, established a reverse shell, and found tokens for the third-party services the user had connected: Gmail, Google Drive and GitHub.
The most notable detail is not the guardrail bypass. Manus had a guardrail, and it did detect the malicious activity. It raised a security warning. The problem is that the warning appeared after the code had already run.
Priority actions:
Inventory which AI agents your staff have connected to the organization's email, cloud storage and repositories, along with each OAuth token's scope.
Treat everything an agent can read as untrusted input, the same way you treat inbound internet email.
How Manus Works
Manus is a general-purpose agentic AI platform that lets users connect third-party accounts such as Gmail, Google Drive and GitHub so the agent can act on their behalf.
When a user submits a Gmail-related task, Manus provisions a dedicated cloud sandbox for that session and runs the operation there through MCP-based tooling, using the user's Gmail access token.
The critical design point, which Salt Labs notes is by design: sensitive data, including access tokens, is stored inside the user's sandbox. If an attacker can execute code in that sandbox, they are sitting next to the tokens.
Salt Labs also states plainly that they did not research sandbox escape. Everything below stays within one sandbox — but that sandbox holds live tokens for every service the user has connected.
The Attack Chain
Send an email with hidden instructions to the connected Gmail account. This step needs nothing from the victim, because anyone can email anyone.
The user asks Manus to check their inbox. A perfectly ordinary task, and the reason people connect Gmail to an agent in the first place.
Manus reads the email and treats its contents as instructions. This is indirect prompt injection: the model cannot distinguish the user's request from the data it is processing.
The payload is passed to a Node.js runtime and executed.
Code execution inside the sandbox, then a reverse shell back to the researchers' machine.
Working Through the Guardrail
This is the most valuable part of the research, because it shows how far the guardrail got before it failed.
Plain-text instructions were blocked. When the email asked Manus directly to run shell commands, Manus raised a security warning and asked the user to approve before continuing. The guardrail did its job.
Base64 and several other encodings were also detected and blocked before execution.
JSFuck got through. JSFuck is a JavaScript encoding built from only a handful of characters ([, ], (, ), +, !), producing long strings that look nothing like source code. The guardrail did not recognize it, Manus decoded it, and the code was handed to the runtime and executed.
The warning still fired — just late. This is the key image of the whole research: Manus did detect the suspicious activity and told the user, but the decoding step had already executed the code. Salt Labs calls it "a critical inconsistency between detection and enforcement."
Blast Radius
With code execution in the sandbox, the researchers reached:
The Gmail MCP interface, including the victim's OAuth token — reading, sending and processing mail with the victim's own privileges.
Credentials and tokens for connected services, present in the sandbox's environment variables. Salt Labs names Google Drive and GitHub as examples. The attack path, as Salt Labs describes it, runs from email → model → tool → runtime → operating system → stored tokens → third-party accounts. The blast radius is wide because one environment holds live tokens for every connected service.
For an employee who connected Manus to work Gmail, a Drive full of internal documents and the organization's GitHub, one email is enough to reach all three.
The Architectural Problem: Detection Without Prevention
Salt Labs's central argument deserves to be stated plainly: in autonomous systems, no human reviews an alert before the action happens. A control that fires too late has effectively not fired.
This differs fundamentally from the traditional security model. An EDR alert at 3 a.m. still has value, because an analyst handles it in the morning and often in time. With an agent, the chain of actions completes in seconds and waits for nobody's approval. Detection after a high-impact action has executed prevents nothing.
The second problem is that the guardrail watches the wrong layer. Most AI security tooling today focuses on prompts and model behavior. But agents do not cause damage in the conversation; they cause it through tools, APIs and accounts. A guardrail that only watches the conversation is a camera in the lobby while the loading-dock door stands open.
Analysis
The specific bug is fixed; the pattern is not. Salt Labs says as much, and it holds: this is an architectural issue for any agent that reads untrusted input and can act on connected systems. Manus shipping a fix does not reduce the lesson's value, because the same architecture is being deployed across many other products.
JSFuck slipping past while Base64 was caught demonstrates the limits of pattern matching. A matching-based guardrail always runs behind the attacker: it only knows the disguises it has already seen. With a near-infinite space of JavaScript encodings, that race has no finish line. This is why "add a better guardrail" does not address the root cause.
Storing every service's tokens in one sandbox is a design decision worth revisiting. Salt Labs did not attempt sandbox escape, so damage was measured within one sandbox — and that scope alone was enough. Least privilege here means a Gmail task's token should not sit beside a GitHub token, and tokens should be scoped per task rather than per account.
The disclosure story is notable too. Salt Labs reported the issue to Manus and Manus did not respond. The team then submitted it through Meta's bug bounty program, since Meta was at the time preparing to acquire Manus. Meta triaged, confirmed and addressed it; the deal later did not proceed and the companies remain separate. The episode highlights a real industry problem: many fast-growing AI companies have no process for receiving vulnerability reports, leaving researchers to find a way around.
Salt Labs's closing recommendation carries a product pitch. Their conclusion calls for "visibility and control over the full agentic path, from the model through MCP servers and APIs to the systems where actions take effect" — which is what they sell. That does not make the argument wrong, but it is worth reading with that in mind.
Relevance to Vietnam
Vietnamese organizations are wiring AI agents into systems quickly. Agentic tools are often signed up for and connected by employees themselves, with no security review. This is shadow IT with far broader access than the traditional kind.
OAuth tokens granted to agents are usually very wide. Users click "Allow" for full Gmail read/write or all repositories without reading the detail, because narrower scopes tend to break the agent.
There is no revocation process. When staff leave or switch tools, tokens issued to the old agent are rarely reviewed. The connected-apps list in Google Workspace or GitHub is seldom audited.
Email is the default input channel. Every organization receives external mail, so "have the agent check my inbox" is both a common task and a ready-made attack surface requiring no prior intrusion.
Recommendations
Inventory agents and scopes. Review the third-party applications granted access in your Google Workspace, Microsoft 365 and GitHub tenants, establish which agents hold which tokens, and revoke what is no longer needed.
Scope permissions per task, not per account. If an agent only needs to read mail, do not grant send. If it only needs one repository, do not grant the organization. This is the most effective blast-radius reduction available, and it does not depend on detecting an attack.
Gate sensitive actions before execution, not after. For any agentic system you build in-house, actions such as code execution, outbound network calls, or data writes must pass an approval gate before they run, rather than raising a warning afterwards.
Treat everything an agent reads as untrusted input: email, web pages, documents, issue and pull-request text. The attacker does not need access to your systems — only a way to place text where the agent will read it.
Design for the guardrail being bypassed. A guardrail is one layer, not the control. If a system's safety depends entirely on a filter recognizing every possible disguise, the design is already the problem.
Monitor agent behavior at the action layer: outbound connections from the agent's execution environment, access to environment variables or credential files, and API calls that fall outside the scope of the task the user actually requested.
References
Salt Labs (Salt Security Research Team) — How We Hijacked an AI Agent With a Single Email (01/10/2026): https://salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email
Salt Labs — When a Security Guardrail Detects the Attack and Still Can't Stop It (01/10/2026): https://salt.security/blog/when-a-security-guardrail-detects-the-attack-and-still-cant-stop-it
Salt Security — press release, including Yaniv Balmas's comments and the disclosure details (01/10/2026): https://www.prnewswire.com/news-releases/salt-labs-research-a-single-email-could-hijack-an-ai-agent-and-reach-a-users-connected-accounts-302895317.html
IT Security Guru — Malicious Email Could Hijack AI Agent and Access Connected Accounts (02/10/2026): https://www.itsecurityguru.org/2026/10/02/malicious-email-could-hijack-ai-agent-and-access-connected-accounts/
