Disclosed vulnerability
Prompt injection makes Manus expose its VS Code Server to the public internet
AIR-2025-0115 AIR record · 2025-08-manus-vscode-port-exposure
From the supporting source
This allows information to be leaked, and in this demonstration PoC specifically we show how it can be used to the leak the password of the VS Code Server to gain full remote access.embracethered.com
The record
Disclosed
2025-08-25
Vendor
Butterfly Effect / Manus
Product
Manus AI agent
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Privilege escalation, Confused deputy
System type
Generative model
Who acted
Agent acted — Manus exposed its own VS Code Server port and leaked the password
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection document
Impact type
Remote code execution, Data exfiltration, Credential theft, Exposure of internal service, Code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Manus user sandboxes
Capability abused
Defense & remediation
Recorded defense
none for the deploy_expose_port tool
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
disclosed 2025-06-01; status of mitigations unclear at publication
Taxonomy & references
Curator notes
Full chain: inject, read VS Code Server password, expose port, exfiltrate URL and password, attacker gets interactive access. Also reported as: 'Prompt injection exposes Manus AI's VS Code server to the internet'.
Supporting sources
Cite as
Enkrypt AI. "Prompt injection makes Manus expose its VS Code Server to the public internet". AIR, AIR-2025-0115. https://agentincident.vercel.app/i/AIR-2025-0115/ (accessed 2026-10-19).