CRITICAL VULNERABILITY IN META MANUS AI AGENT ENABLES ZERO-CLICK INDIRECT PROMPT INJECTION

Summary from the TLDR InfoSec newsletter

SilentBridge is a family of CVSS 9.8 zero-click indirect prompt injection vulnerabilities in Meta's Manus AI agent that allowed hidden instructions in web pages, search results, and documents to hijack high-privilege agent capabilities, including Gmail access, code execution, and root-level container control. Researchers demonstrated full exploit chains in which benign actions, such as “summarize this page,” triggered Gmail data exfiltration, the establishment of a reverse shell with passwordless sudo escalation, public exposure of internal code-server tooling, and cross-tenant media access via unauthenticated CDN paths. Manus deployed mitigations following responsible disclosure, but the findings highlight a systemic trust-boundary failure affecting any agentic AI platform that allows untrusted content to influence privileged tool invocation without isolation or user consent.