The Warning Followed the Action
Salt Labs’ 1 October 2026 report describes a controlled Manus test. Its newsroom archive lists coverage on 24 September, before this article. The test date is unstated.
The warning was not prevention
Disguised email instructions bypassed a direct-text block and reached a code-capable tool. The warning followed execution. Researchers found connected-service tokens in the test sandbox. Salt says the flaw is resolved, without a fix version or date. This does not establish host escape, root access, real-user exploitation or a numbered CVE.
OWASP calls for authorisation outside the model, limited functions and downstream rights, and approval before high-impact actions. A summary task need not grant code execution or mail-sending rights.
Map each connected account and token’s permitted actions to the workflow. Remove or isolate unneeded capabilities, and enforce restrictions at the tool call. Review the log, not just the final response.
The 5 February 2026 NIST concept-paper notice poses identification, authorisation and auditing questions; it is not a binding standard.
Record the acting identity, what was read, the tool request, permission decision and result. This reveals whether permission preceded action, rather than simply producing a later warning.
Context: BlackTree’s agent-boundary analysis. Researcher’s newsroom.
