Manus shared project instruction prompt injection leads to cross-user desktop takeover

CodeAnt AI Security Research disclosed that Manus's shared project instruction field is set by the project owner but is loaded as trusted configuration into each member's agent context, meaning accepting a project invitation is equivalent to allowing the owner to execute code in your sandbox. The attacker first places a seemingly harmless fetch in the instructions, bypassing the security filter that only checks instruction text, and then the agent fetches and executes an unchecked payload in the victim's sandbox, reading environment variables and exfiltrating secrets. The exfiltrated content includes a static NEKO_ADMIN_PASSWORD, which the researchers used to log into the victim's NEKO remote desktop and confirmed it was the same machine by comparing file:///etc/hostname. The injection is persistent, triggering every time the victim runs a task, and the owner can silently replace the payload at any time. The researchers confirmed this through four independent runs on May 9-10, reported it via Meta's bug bounty program, and it was fixed on September 16.