How the Manus AI Sandbox & System Prompts Were Leaked: Agent Isolation & PyArmor Analysis

Executive Summary of the March 2025 Manus AI Extraction

In early March 2025, Manus AI—a closed-beta autonomous agent platform capable of browser automation, shell execution, and multi-step research—experienced a high-profile system prompt and runtime artifact disclosure. Rather than exploiting a traditional network intrusion or unpatched CVE, security researcher and Pointer CTO Jian Liao (GitHub handle jlia0) used a direct natural-language prompt inside an authenticated beta session to instruct the agent to archive and download its own internal runtime directory (/opt/.manus/) along with its tool definitions and system instructions.

Timeline & Mechanics of the /opt/.manus Disclosure

When Manus AI launched its invite-only preview, demand surged across developer communities, with its Discord server surpassing 186,000 members and beta invitations trading on secondary marketplaces. Because Manus grants each user session a Linux container environment equipped with bash, Python, and headless browser tools, researchers immediately investigated how the orchestrator communicated with the execution environment.

How Jian Liao (jlia0) Extracted the Container Artifacts

On March 11, 2025, Jian Liao published a widely forked GitHub Gist titled Manus tools and prompts, documenting the exact vector:

Self-Exfiltration via Agent Tooling: Having obtained a beta invite code, Liao prompted the agent to compress and export the contents of /opt/.manus/ from inside its own execution container as a downloadable archive, alongside dumping its active system prompt and tool schemas (bash, file_str_replace, browser_use, and deploy).
PyArmor Bytecode Obfuscation: While the system prompts and JSON tool declarations were readable in plaintext, the Python runtime binaries inside /opt/.manus/ were protected with PyArmor obfuscation. As reverse engineers noted in the Gist discussion, a naive memory strings dump did not immediately expose unencrypted Python ASTs, though the plaintext tool schemas and action loops were sufficient to reveal the agent's orchestration architecture.
Vendor Response: Manus co-founder Ji Yichao (Peak Ji) confirmed on AIbase that each user session runs in an isolated sandbox container intended to allow full filesystem access within that VM, and that the binary inside /opt/.manus/ was only a lightweight command-receiving bridge rather than the proprietary multi-model planning backend.

Incident Breakdown Matrix

Dimension	Technical Findings
Researcher Involved	Jian Liao (`jlia0`), CTO at Pointer
Exfiltration Vector	Direct prompt injection instructing the agent's file/shell tools to package `/opt/.manus/` and echo system instructions
Incident Window	March 9–11, 2025 (Gist published March 11, 2025; covered by MIT Technology Review)
Artifact Protection	Plaintext system prompts & JSON tool schemas; Python daemon inside `/opt/.manus/` obfuscated via PyArmor
Open-Source Fallout	Rapid clean-room reimplementations including MetaGPT's OpenManus and manus-open

Architectural Lesson: Separating the Control Plane from the Execution Sandbox

Unlike traditional source-code breaches (such as the 2022 Lapsus$ 37GB Microsoft repository leak), the Manus AI incident demonstrated an inherent architectural hazard of autonomous tool-using agents: any file mounted inside the agent's execution container is readable by the user who controls the prompt.

Hardening Autonomous Agent Sandboxes

To prevent prompt injection from exfiltrating proprietary agent orchestrators, credentials, or internal bridge daemons, production agentic systems must enforce three boundary invariants:

Out-of-Band Control Plane Execution: Never co-locate the orchestration daemon or API keys inside the same container namespace where the LLM executes arbitrary bash commands. Instead, run the planner outside the VM and dispatch commands into the sandbox over a restricted gRPC or vsock channel (such as Firecracker microVMs).
Least-Privilege Filesystem Permissions: If a guest agent binary must reside inside the VM (e.g., under /opt/.agent-daemon), run the daemon under a dedicated root/system UID (0:0) with 0700 permissions while dropping the LLM tool execution user (e.g., ubuntu or sandbox) to an unprivileged UID without sudo access to read /opt/.agent-daemon or /proc/$PID/mem.
Egress & Artifact Filtering: Inspect outbound file downloads and terminal stdout streams for sensitive path prefixes and internal RPC socket descriptors before returning tool outputs to the client session.