JavaScript Obfuscation

JavaScript obfuscation is the practice of deliberately rewriting web code so that humans and automated scanners find it hard to read, while the browser still runs it normally. Attackers use it to hide malicious scripts, such as those that steal login details or skim payment card data on checkout pages, from security tools and reviewers. For enterprises, the risk is that a compromised website or third-party script can carry concealed code that passes routine review, so governance teams should require script inventories and monitoring for unexpected changes to code running on their customer-facing pages.

1 item

ResearchGlobal2026-10-08

JavaScript Obfuscation Defeats Manus Agent Defenses, Exposing Inspection-Only Controls

Salt Labs researchers bypassed prompt-injection defenses in the Manus AI agent by hiding instructions inside an email using JavaScript obfuscation. The agent decoded and acted on those hidden instructions without detecting the attack. The finding shows that content inspection alone cannot protect agents that can run code or take actions based on untrusted input.

Manus prompt injection agentic AI agent security JavaScript obfuscation Salt Labs email attack surface