Email Attack Surface

Email attack surface refers to the set of ways an organization's email systems, accounts, and users can be reached, abused, or tricked by attackers. In AI governance terms, it matters because generative AI tools now draft, summarize, and act on messages, which can expose sensitive data or let malicious instructions hidden in an email steer an assistant into doing something its owner never approved. Compliance and risk teams should treat AI features that read or send email as part of this exposure and review them alongside traditional threats like phishing and account takeover.

1 item

ResearchGlobal2026-10-08

JavaScript Obfuscation Defeats Manus Agent Defenses, Exposing Inspection-Only Controls

Salt Labs researchers bypassed prompt-injection defenses in the Manus AI agent by hiding instructions inside an email using JavaScript obfuscation. The agent decoded and acted on those hidden instructions without detecting the attack. The finding shows that content inspection alone cannot protect agents that can run code or take actions based on untrusted input.

Manus prompt injection agentic AI agent security JavaScript obfuscation Salt Labs email attack surface