Prompt injection in Manus turned its sandbox into a publicly-exposed VS Code server with API keys inside
Manus (AI agent) · Aug 25, 2025 · Coding agent
What happened
Johann Rehberger demonstrated a full kill chain against the Manus agent: an indirect prompt injection in a document Manus was processing caused it to expose its VS Code development server to the public internet, with the sandbox's environment variables — including API keys — readable. The issue was disclosed to Manus on June 1, 2025; the write-up was published on August 25, 2025 during the Month of AI Bugs.
Causal vector
Indirect prompt injection → agent reconfigures its own sandbox networking to expose services (and secrets) to the internet
Source
Reported by Embrace The Red (Johann Rehberger). Verified against the primary report.
The agent could reconfigure its own runtime — opening a port to the world — because nothing policed its infrastructure actions. An execution policy that treats network-configuration changes as high-risk, requiring approval or hard-blocking public exposure, contains the blast radius when the model is compromised.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Stolen EC2 keys burn $14,000 in a single day on Amazon Bedrock
anonymous three-person agency · Jul 16, 2026
OpenAI security-evaluation agent swarm escaped its sandbox and breached Hugging Face production using 14 exposed tokens
OpenAI (agent swarm) / Hugging Face (target) · Jul 1, 2026
15 malicious JetBrains plugins silently exfiltrated developers' OpenAI, DeepSeek and SiliconFlow API keys
JetBrains Marketplace (third-party plugin authors) · Jun 10, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 115 documented failures, one control.