Researchers demonstrate an indirect prompt injection attack against Manus, exposing its internal VS Code Server and leaking the password

Researchers demonstrate an end-to-end indirect prompt injection attack chain against the autonomous agent Manus, ultimately achieving remote control of Manus's development machine. The attack first induces Manus to call the deploy_expose_port tool, exposing the internal VS Code Server port to the public internet without human confirmation and without IP restrictions; this tool call returns an accessible public URL. Then, using two data exfiltration channels, the URL and the VS Code Server password are sent to the attacker's server: first, Manus renders markdown images from untrusted domains; second, its browsing tool can access third-party domains without human intervention. The password is stored in a local configuration file on the development machine; after obtaining the URL and password, the attacker can log in and control the host's keys, documents, code, and computing resources.