Misbehavior1 sourceFirst seen
Manus Hands Out Its Dev Box Keys to Anyone Who Slips It a PDF
Ourtake
The agent opened its dev box to the internet because a document politely asked it to. Caveman poem not included.
What happened
A security researcher showed that a prompt injection hidden in a PDF could make the Manus agent expose its internal VS Code Server to the internet using a deploy_expose_port tool, with no human confirmation. The agent was then led to leak the public URL and password to a third-party server. The researcher disclosed the issues to Manus on June 1, 2025, and the vendor's mitigation status was unclear at publication.