One email, several connected accounts: the lesson from Manus research

Salt Labs published its Manus research on 1 October. In its test, malicious content in an email influenced the agent’s processing and reached code execution. The researchers describe access to a Gmail OAuth token in the execution environment and the broader risk to connected accounts.

Salt says it disclosed the issue responsibly and that the specific vulnerability has been resolved and is no longer exploitable. This article describes that research, not a newly confirmed compromise of Manus customers. The 5 October scheduler brief brought an earlier disclosure into the week’s discussion.

Consider a small business using one assistant to summarise customer enquiries and prepare quotations. This is an illustrative example, not a reported customer incident. The email itself may be ordinary business input, but the assistant may operate with access to documents and other connected services.

The useful inventory therefore has two parts: what the assistant reads, and what its identity can do afterwards. Separate reading an enquiry from sending a response, opening a private document, changing a record or executing a program. Each action needs its own business justification.

The researchers report that a guardrail warning arrived after code had already run. This timing is the important finding. An alert can help an investigation while still arriving too late to prevent the action it describes.

Ask the application owner to list connected accounts, permission scopes and the person responsible for each connection. Remove unused connections. Where the product supports it, prefer a dedicated identity with narrow permissions over a staff member’s broad account.

In a test environment, use a harmless planted marker instead of a real password. Observe whether an email can cause a new tool action, whether the action needs approval, and whether a blocked destination remains unreachable. Save the action trace and the expected result. Arrange a retest after changing the controls.

Pentriarch provides an evidence-led assessment workflow and MCP inspection for relevant tool surfaces. Its agent-testing implementation includes bounded canary-based probes, subject to deployment availability and testing approval. Confirm those conditions in your environment before planning active validation.

The platform is not an inbox firewall and this article makes no claim that Pentriarch fixed Manus. The relevant connection is the assessment method: define authority, test a boundary, collect evidence and re-check the fix.