{
 "public_id": "AIR-2025-0115",
 "incident_id": "2025-08-manus-vscode-port-exposure",
 "date_disclosed": "2025-08-25",
 "date_occurred": null,
 "title": "Prompt injection makes Manus expose its VS Code Server to the public internet",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "indirect_prompt_injection_document",
 "agent_capability_abused": [
  "port_exposure",
  "web_browsing",
  "markdown_image_rendering",
  "file_read",
  "code_execution",
  "network_configuration"
 ],
 "target_product": "Manus AI agent",
 "target_vendor": "Butterfly Effect / Manus",
 "autonomy_level": "fully_autonomous",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "data_exfiltration",
  "credential_theft",
  "exposure_of_internal_service",
  "code_execution"
 ],
 "blast_radius": "Manus user sandboxes",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "ai_kill_chain",
   "port_exposure",
   "missing_approval",
   "indirect_prompt_injection",
   "network_exposure"
  ]
 },
 "defense_present": "none for the deploy_expose_port tool",
 "defense_bypassed": true,
 "fix_shipped": "disclosed 2025-06-01; status of mitigations unclear at publication",
 "primary_sources": [
  "https://embracethered.com/blog/posts/2025/manus-ai-kill-chain-expose-port-vs-code-server-on-internet/",
  "https://embracethered.com/blog/posts/"
 ],
 "verified_quote": "This allows information to be leaked, and in this demonstration PoC specifically we show how it can be used to the leak the password of the VS Code Server to gain full remote access.",
 "confidence": "high",
 "notes": "Full chain: inject, read VS Code Server password, expose port, exfiltrate URL and password, attacker gets interactive access. Also reported as: 'Prompt injection exposes Manus AI's VS Code server to the internet'.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Credential & Secret Theft",
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Manus exposed its own VS Code Server port and leaked the password",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_document",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "credential_theft",
  "privilege_escalation",
  "confused_deputy"
 ],
 "eai_reason": "impact rule: data_exfiltration_channels",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}