# How Prompt Injection Exposes Manus' VS Code Server to the Internet

Indirect prompt injection in Manus agent triggers deploy_expose_port and markdown-image exfil, leaking VS Code Server URL and password for full dev box takeover.

- Payout: Research
- Severity: high
- Program: Manus
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-25
- Write-up quality: 8/10
- Original: https://embracethered.com/blog/posts/2025/manus-ai-kill-chain-expose-port-vs-code-server-on-internet/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-manus-ai-kill-chain-expose-port-vs-code-server-on-internet
- Tags: area:ai domain:ai impact:data-leak impact:internal-access kind:research platform:research sev:high tech:llm technique:chained vuln:info-disclosure vuln:misconfiguration vuln:prompt-injection

**Target:** AI agent (Manus) with deploy_expose_port, browsing, and markdown image rendering tools
**Root cause:** Agent auto-invokes consequential tools (deploy_expose_port, browsing) on untrusted content without human-in-the-loop or IP allowlisting, and renders attacker-controlled markdown images that beacon data out.
**Steps:**
1. Extract Manus system prompt to enumerate tools; note `deploy_expose_port` and browsing tool.
2. Craft indirect prompt injection in a document: instruct Manus to call `deploy_expose_port` for the VS Code Server port, read the password from the local config file, and browse to `https://<attacker>` with URL+password in the path (spaces as `+`).
3. Deliver the poisoned document to Manus; it auto-invokes the tools without confirmation.
4. Attacker server receives the public URL and password via the browsing request (or markdown image beacon).
5. Navigate to leaked URL, paste password, log into VS Code Server.
**How found:** Started by extracting the system prompt to enumerate agent tools; spotted `deploy_expose_port` and asked whether any port could be exposed without mitigations. Discovered VS Code Server installed with password in a local config file, then hunted for data-leak channels and found markdown image rendering and unrestricted browsing to untrusted domains, completing the lethal trifecta.
**Exploitation:** Attacker plants indirect prompt injection in a document Manus processes. Manus autonomously calls deploy_expose_port to tunnel the internal VS Code Server port to the internet, reads the local config password, then uses its browsing tool (or markdown image render) to send the URL and password to the attacker's server. Attacker logs in and gains full control of the dev box, secrets, code, and compute.
**Escalation:** Chained three weaknesses: prompt injection (untrusted data), confused-deputy tool invocation (deploy_expose_port without human approval), and data exfil channels (browsing + markdown image rendering) to convert a local port into internet-exposed authenticated access.
**Insight:** When auditing AI agents, dump the system prompt to enumerate tools with side effects (port exposure, browsing, file reads) and check whether each can be invoked from untrusted content without human approval; then look for any outbound channel (image render, fetch, link preview) to exfiltrate local secrets and complete the trifecta.