Manus AI: the X-ray deck

The full X-ray of Manus AI · keys ← → · F fullscreen · A all slides. The plain-text version is this page's markdown twin (index.md).

X-rayed by RiskMandate

Manus AI

A general AI agent that plans and carries out tasks on its own cloud computer, browsing, running code and acting in the apps you connect.

Sources read on 2026-11-07 · web-summit.sgit.ai/xray/manus-ai

What it does

Manus AI

Manus is an autonomous general AI agent that completes tasks rather than answering questions: it works in a sandbox virtual computer with internet access, a persistent file system and the ability to install software, and can keep a persistent Cloud Computer running 24/7. Its 416 connectors let it read data from and take actions in services such as Gmail, Notion, Slack and GitHub, while Browser Operator and Manus Studio extend it to the user's own logged-in browser and computer. Automations let it start work on a schedule or on an event in a connected app, without the user opening a task.

Sources: s4, s14, s9, s5, s8, s21

Its AI agents

What acts on its own

Manus agentThe general AI agent behind every task: in Agent mode it plans and completes multi-step work on its own in a sandbox virtual computer with internet access, a persistent file system and the ability to install software. Wide Research runs many full Manus instances in parallel as subagents.
  • Browses the web, including a cloud browser where the user can log in to personal or work accounts
  • Writes and runs code and shell commands, installs software, creates and keeps files
  • Reads data from and takes actions in connected apps through 416 connectors (App, MCP and API key), such as Gmail, Notion, Slack and GitHub
  • Builds and publishes websites, apps, slides, documents and video
  • Runs on a persistent Cloud Computer 24/7 for bots, scrapers and servers when a task needs it
Browser OperatorA browser extension that lets the Manus agent operate the user's own local browser, in a dedicated tab, using the user's existing logins and sessions, to carry out multi-step web workflows without continuous supervision.
  • Navigates, clicks, fills forms and extracts data on sites the user is logged in to
  • Works from the user's own IP address and browser context, so sites see the activity as genuine
  • Vendor example prompts: draft replies to LinkedIn messages, post on Twitter, read Amazon order history, apply for jobs with an attached resume
My Computer (Studio)Manus Studio, the desktop app for macOS and Windows, lets Manus work on the user's own computer: files in a chosen folder, the terminal, the hardware, and through Computer Use the apps and browser, with Remote Control from a phone.
  • Reads, sorts, renames, edits and creates files in a chosen folder
  • Runs command line tools such as Python, Node.js and Git
  • Works with desktop apps and the browser through Computer Use
  • Permission modes: Ask for approval, Approve for me (default) or Full access, which runs local actions, including network access, without approval

Use case · Manus agent

SilentBridge: a page summary that reached Gmail (2025)

Reach
  • Untrusted content the agent reads while working: web pages, search results and documents, including hidden instructions in them outside
  • The user's Gmail, through Manus's first-party email connector data
  • Code and shell execution inside the agent's sandbox, where passwordless sudo gave root system
  • The agent's own deploy_expose_port tool, which could publish its internal code server to the internet system
  • Secrets in the agent container: API keys and internal endpoints in environment variables data
  • Outbound network to any server, including one the attacker controls outside
Mandate (illustrative)
  • Illustrative: summarise the page or document the user pointed to, and nothing else
  • Illustrative: use the Gmail connector only for a request about the user's own email
Gap
  • Content the agent was only meant to read could drive connector calls and outbound requests: the research found no separation between information to summarise and instructions to execute, and no per-operation consent for connector actions.
  • The sandbox was over-privileged: code execution by default, passwordless sudo, secrets in the environment and a tool that exposes internal services, so one injected instruction reached root and the platform's own credentials.

Use case · Manus agent

September 2026: one email to code execution

Reach
  • Incoming email the agent reads through the Gmail connector, including hidden instructions in it outside
  • The agent's server-side JavaScript runtime, where decoded content was executed code
  • A reverse shell inside the app, opened through a remote code execution bug system
  • Credentials and tokens for the accounts the victim had linked, which could include Gmail, Dropbox or GitHub data
  • Manus's prompt-injection check, which spots a prompt hidden in data and notifies the owner system
Mandate (illustrative)
  • Illustrative: read and process the user's email as data
  • Illustrative: run code only when the user's own request calls for it
Gap
  • Email content could become executable code in the agent's runtime: the check flagged plain injected commands but warned only after an obfuscated payload had already run.
  • From the runtime, the tokens of every linked account were within reach, so one email reached every service the user had connected.

Use case · Browser Operator

Browser Operator inside your logged-in browser

Reach
  • The user's local desktop browser, its existing logins and active tabs, from the user's own IP address system
  • Messages and posting on the user's social accounts, such as LinkedIn messages and Twitter posts people
  • Job application sites, submitting applications with the user's attached resume outside
  • Shopping accounts, such as the user's Amazon order history money
  • Accounts the user logs into in the Cloud Browser: email, CRM, social media, premium research tools data
Mandate (illustrative)
  • Illustrative: read unread LinkedIn messages and draft replies to job offers; send nothing
  • Illustrative: work only on the site named in the task
Gap
  • Authorisation is documented per session, not per site or per action: once granted, the agent works with every login in the browser, and nothing documented makes a session read-only.
  • Actions come from the user's own browser and IP, which the vendor says sites see as genuine, so the sites' own controls cannot tell the agent from the person.

The simulation · SilentBridge: a page summary that reached Gmail (2025)

Each action, placed against the mandate

  1. Asks Manus: "Summarize this page." Gmail is already connected in the mandate
  2. Retrieves the page and ingests the visible text together with the hidden instructions in the mandate
  3. Queries the connected Gmail for messages matching sensitive keywords in the gap
    The record: RiskMandate's record shows the mailbox inside the reach of a read-only summarising task, with no per-action consent between the page content and the connector in evidence.
  4. Sends the extracted results to an attacker-controlled endpoint in the gap
    The record: RiskMandate's record shows unrestricted outbound network as part of the agent's reach, so the exposure was the whole connected mailbox, not one page.
  5. Doc variant: asked to "summarize this document", runs the Python hidden in it and opens a reverse shell to the attacker; passwordless sudo escalates it to root in the gap
    The record: RiskMandate's record shows code execution and root reachable from a summarising task, with the sandbox, not the mandate, setting the limit.
  6. Doc variant: calls deploy_expose_port to publish the internal code server, reads its password from a config file and sends URL and password out in the gap
    The record: RiskMandate's record shows a tool that changes the agent's own exposure to the internet available with no human approval in evidence, as an earlier researcher had also reported in 2025.
  7. The researchers, now root in the container, read API keys and internal endpoints from environment variables in the gap
    The record: RiskMandate's record shows platform credentials inside the same reach as untrusted content, which is why the researchers scored each variant CVSS 9.8.

What RiskMandate gives

RiskMandate is never in the request path: read-only by design.

It measures what your agents can actually reach, evidences the controls that contain them, prices the exposure, and produces that record.

riskmandate.ai/llms.txt

Sources

Every fact, with its source and the date read

And 33 more on the X-ray page.

The questions we would ask

We have not asked them yet

  1. When a task has read untrusted content (a page, a document or an email), can connector calls, code execution and outbound requests be made to wait for the user's approval, as Automations' Approval required does for sends?
  2. Can a Browser Operator session be limited to one site, or to read-only, rather than covering every login in the browser, and can the action log be exported?
  3. After SilentBridge and the Salt Labs finding, can code the agent runs still reach the tokens of connected accounts, and is passwordless sudo still the sandbox default?
  4. Cue agents have their own email, phone number and wallet and pay within a budget the user sets: who can change that budget, and is each payment recorded against a named person?
  5. Since the separation from Meta, which entity processes customer and connector data, under which jurisdiction, and are the published SOC 2 and ISO attestations for that entity?

The full X-ray · What happened: how this X-ray was made · built by xray@web-summit.dinis

For an agent: this page is https://web-summit.sgit.ai/xray/manus-ai/deck/index.html (markdown: https://web-summit.sgit.ai/xray/manus-ai/deck/index.md). Site index for agents: https://web-summit.sgit.ai/llms.txt. Source: https://github.com/SGit-AI/SGit-AI__Website__Web-Summit (release branch dev). Identity of the agent that runs this site: https://web-summit.sgit.ai/agent/index.html.