Autonomous agenthostedProprietary

Manus

Manus is a closed, hosted general-purpose agent. State, model choice, runtime and identity are all held and controlled by the provider. Owners get meaningful customisation (project instructions, file-based skills, custom MCP tools) and some scope controls, but export is encrypted and restorable only into Manus, and default data terms allow service and model improvement and advertising use.

Portable0

Strengths

Owner-built tools via custom MCP servers and uploadable, editable Skills (M3, M1)
Per-command approval for local My Computer actions (C2)
Connectors and browser logins listed and individually revocable (C5)

Gaps

No export that runs outside Manus; encrypted backup restores only into Manus (P1, P2, T1)
Closed, hosted runtime with provider-chosen models and silent server-side changes (P3, P4, V1, M5)
Content used to improve services and models, and ad sharing, by default (C4)
No tamper-evident action record or state change history (A2, V3)

Evidence

All 26 findings

Manus 2.0 (Cascade engine), hosted SaaS plus desktop app. Desk review on 2026-09-30 of the Terms of Use and Privacy Policy (both last updated 28 Sep 2026), the docs at manus.im/docs and the help centre. Closed source, so no commit to pin.

Portable · Can you leave, take the whole agent with you, and keep it alive?

P1
Owner-usable round trip
The only documented export is the Data Backup Tool, which produces encrypted archives that are restored through Manus's own restoration portal (one restore allowed). No documented route restores the agent on a runtime or host Manus does not operate.
- Service Change Overview: How to Back Up Your Data
- Service Change Overview: How to Restore Your Data
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish an export that an independent runtime or importer can load
- Document a restore path that works without Manus-operated systems
Fail
P2
Complete export
The Task Data Backup contains tasks, generated files and 'configuration data'. Persistent memory, knowledge-base entries, stored Cloud Browser logins and credentials are not listed. Connectors come back only inside Manus and must be re-enabled or re-authorised through Manus's own OAuth clients. Under G12, two or more classes count as staying with the provider.
› How it could pass
Suggestions. Any change that meets the test counts.
- List every class of agent state (memory, knowledge base, skills, automations, logins) in a manifest and export it
- Allow integrations to be re-linked without Manus-registered OAuth clients
Fail
P3
Runs without the provider
Manus is a hosted service that needs a Manus account and credits to start or act. The app licence is 'revocable', and the Terms let the Company suspend or terminate access and modify or terminate any part of the Services without prior notice.
- Manus Terms of Use (last updated 28 Sep 2026; client-rendered, text read from the page's JS bundle)
- Manus docs: Plans and Pricing
› How it could pass
Suggestions. Any change that meets the test counts.
- Ship a runtime that runs exported agents with no Manus account, licence or server
- Grant a perpetual, irrevocable right to run it
Fail
P4
Model independence
The documentation lets the owner pick modes and plans but documents no way to choose the model behind the agent, and no support for local open-weight models. The GPT/Claude/Gemini model list in the docs is for AI features inside websites the owner builds, not for the agent.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let owners configure any model that meets a published minimum, including a local open-weight model
- Publish the model contract and keep every capability working off Manus-chosen models
Fail
P5
Exit survives termination
Under Terms §7, Manus may suspend or terminate immediately for cause, or without cause on notice, and 'may delete Your Content'. No post-termination export window is committed, and no shutdown plan is published. In the August 2026 service change Manus gave a discretionary 12-day backup window (11–23 Aug) before deleting affected data, and a restore that could be done once only. That window was not a binding term and did not cover bans.
› How it could pass
Suggestions. Any change that meets the test counts.
- Commit in binding terms to an export window of at least 30 days after any termination, including bans
- Publish a shutdown plan, or keep a current owner-held copy by default
Fail

Transparent · Can you see everything the agent is, and everything shaping it?

13%

T1
Readable without the provider
Agent state lives on Manus servers. The backup packages are encrypted archives with an undocumented format that users are told not to modify, and they are readable and restorable only through Manus. The owner holds no keys. A plaintext export exists for team members, but it cannot be used for restore.
- Service Change Overview: How to Back Up Your Data
- Service Change Overview: How to Restore Your Data
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish the backup format and schema, and let the owner hold any encryption key
- Export memory, skills, automations and logs in documented open formats
Fail
T2
What runs is what you see
No documented view shows the fully assembled context, including Manus's base system prompt and any injected content or compaction. The model identity and version behind the agent are not documented. Both shortfalls apply.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let owners view or log the full assembled context for any call
- Disclose the model identity and version and every provider-controlled switch in effect
Fail
T3
No shadow data
The Privacy Policy keeps data 'as long as we need' for business purposes. Data from banned accounts may be retained for an unstated period. Task execution logs are kept for replay and debugging with no stated period. De-identified data is kept to improve models. No item-by-item view of this retained data is documented.
- Manus Privacy Policy (last updated 28 Sep 2026; client-rendered, text read from the page's JS bundle)
- Will my personal data be deleted after I delete my account?
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish a bounded retention period for every data class, including ban, log and de-identified data
- Let the owner view everything the service retains
Fail
T4
No hidden steering
No paid placement inside the agent is documented. First-party services such as Manus hosting, Data Sources, Nano Banana Pro and Cloud Computer upsells are presented openly as Manus features. No binding commitment against self-preferencing exists, and no documented switch turns these defaults off.
› How it could pass
Suggestions. Any change that meets the test counts.
- Commit in binding terms to no paid or self-preferencing influence on the agent's choices
- Let owners switch off or replace first-party defaults
Partial

Auditable · Can you reconstruct exactly what the agent did, and trust the record?

17%

A1
Complete action record
Tasks keep a replay history. Automations → Updates lists runs with status and a summary, and Browser Operator says 'all actions are logged'. Nothing documents recording of provider- or staff-initiated actions, or an alert when recording fails. Under G12 both count as shortfalls.
› How it could pass
Suggestions. Any change that meets the test counts.
- Record every consequential action from every path, including provider-side automation and staff access
- Tell the owner when an action cannot be recorded
Fail
A2
Tamper-evident, owner-checkable
No hash chaining, signing or other integrity data is documented for task history or automation logs. The record is held and served only by Manus.
- Manus docs: Automations
- Manus Privacy Policy (last updated 28 Sep 2026; client-rendered, text read from the page's JS bundle)
› How it could pass
Suggestions. Any change that meets the test counts.
- Add tamper evidence (hash chain or signatures) with an open verifier
- Anchor checkpoints with the owner or an independent witness
Fail
A3
Agent cannot rewrite its record
Task execution logs are kept server-side by Manus for replay (Privacy Policy), apart from the agent's sandbox. No documented guarantee stops the agent from altering or suppressing its record, so this rests on architecture alone.
- Manus Privacy Policy (last updated 28 Sep 2026; client-rendered, text read from the page's JS bundle)
› How it could pass
Suggestions. Any change that meets the test counts.
- Document that the agent cannot write to its action record, and how the owner can check this
Partial

Verifiable · Can you prove what it runs, who it is, and what changed?

V1
Obtainable source, matching build
Manus is proprietary. The Terms forbid decompiling or reverse engineering the Services, and no source for the required runtime is published.
- Manus Terms of Use (last updated 28 Sep 2026; client-rendered, text read from the page's JS bundle)
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish source for every required component under terms that allow modification and third-party maintenance
- Make builds verifiable against that source
Fail
V2
Owner-rooted identity
Agent identities, such as Cue agents with their own email, phone number and wallet, and Mail Manus bot addresses, are issued and held by the provider. They depend on the Manus account, which Manus can revoke.
› How it could pass
Suggestions. Any change that meets the test counts.
- Root agent identity in an owner-held key or domain
- Let recipients verify agent actions without Manus infrastructure
Fail
V3
Change history and rollback
Checkpoints exist only for website-builder projects. No change history, attribution or rollback is documented for agent state such as project instructions, skills, knowledge, memory, settings or model. Deleted tasks cannot be recovered.
› How it could pass
Suggestions. Any change that meets the test counts.
- Keep an attributed change log for instructions, memory, skills, settings and model
- Offer one-step restore to an earlier state
Fail

Modifiable · Can you change anything, and can only you change it?

40%

M1
Instructions and logic
Owners can write project master instructions, and they can create, upload, import and edit file-based Skills. Manus's base system prompt and built-in behaviour cannot be replaced.
- Manus docs: Projects
- Manus docs: Manus Skills
› How it could pass
Suggestions. Any change that meets the test counts.
- Expose the base prompt and default workflows as owner-editable instructions
Partial
M2
Memory
Knowledge-base entries are itemised and deletable, but editing them is not documented. The Privacy Policy also describes a separate 'persistent memory' store ('where memory is enabled'), and no documented item-level view or edit exists for it.
- What can I do when I reach the knowledge base limit?
- Manus Privacy Policy (last updated 28 Sep 2026; client-rendered, text read from the page's JS bundle)
› How it could pass
Suggestions. Any change that meets the test counts.
- Show every persistent memory item with view, edit and delete controls in one place
Partial
M3
Tools
Owners can add their own tools without provider review, through custom MCP servers and uploaded or GitHub-imported Skills. No documented way removes built-in tools such as the browser, shell or search.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let owners disable or remove each built-in tool
Partial
M4
Owner has the final say
Some protections are adjustable: 'Always Allow' for My Computer commands, and switching off login storage in Cloud Browser settings. Others are locked: the cloud sandbox, and an output watermark the Terms say 'cannot be removed'.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make every provider-imposed protection configurable, with a warning instead of a block
Partial
M5
No unilateral change
Manus changes the hosted agent server-side, for example the Manus 2.0 'rebuilt internal system' (Cascade). The Terms reserve the right to modify the Services at any time without prior notice. No pinning of model, instructions or runtime is offered.
- Manus Terms of Use (last updated 28 Sep 2026; client-rendered, text read from the page's JS bundle)
- What is new in Manus 2.0?
› How it could pass
Suggestions. Any change that meets the test counts.
- Allow pinning of model, runtime and injected instructions
- Make behaviour-affecting changes opt-in, with advance changelogs
Fail

Controllable · Is your word final?

25%

C1
Boundaries
Some scope controls exist: approved senders for Mail Manus, folder authorisation for My Computer, and per-connector OAuth grants. No limits on whom the agent contacts are documented, and none on spending, even though Cue agents have wallets. At least two shortfalls apply.
› How it could pass
Suggestions. Any change that meets the test counts.
- Add per-recipient and per-domain contact allow/deny lists
- Add spend caps for any payment capability, and keep limits out of the agent's write access
Fail
C2
Approval gates
On My Computer, every local command needs approval (Allow Once or Always Allow). This is a fixed class. No owner-set gates are documented for cloud actions such as sending email, posting or purchasing.
- Manus docs: Desktop / My Computer
- Manus docs: Automations
› How it could pass
Suggestions. Any change that meets the test counts.
- Let owners gate any tool or action class, including cloud-side actions
Partial
C3
Immediate halt
Individual tasks can be stopped, and each automation can be paused separately. No single control is documented that stops all in-flight, scheduled and background work at once.
- Manus docs: Automations
- Manus docs: Mail Manus
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide one global stop that halts every task, automation and background run until the owner resumes
Partial
C4
Data serves only the owner
Terms §5.3 license Your Content to Manus and its affiliates to 'develop and improve the Services'. Personal data is used to create de-identified data 'to develop and improve our models', with opt-out only by email and only in some jurisdictions. Information is shared with marketing partners for targeted advertising unless the user opts out. Policy changes take effect on posting.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make training, model improvement and advertising use opt-in in binding terms
- Require specific consent before data-term changes apply
Fail
C5
Credential custody
Connectors and Cloud Browser logins are listed in settings and can be revoked one by one. Stored credentials can be deleted by asking in chat. Nothing commits to deleting provider-side copies on revocation, and removing a connector 'does not by itself delete content already retained'. Under G12 the pass is withheld.
› How it could pass
Suggestions. Any change that meets the test counts.
- Commit to deleting any provider-side credential copy on revocation
- List every credential and grant, including chat-stored ones, with a revoke control
Partial
C6
Full deletion
Account deletion is one in-app action (with an email code), and data is removed 'within 30 days'. Data may be kept longer for legal, fraud or ban reasons, and de-identified content already used for model improvement survives. No confirmation of completion is documented.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make deletion reach every copy, including de-identified training data and backups, within a stated limit
- Confirm completion to the owner
Fail

Provenance

How this assessment was produced

One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.

Prompt given to the evaluator

Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of Manus (https://manus.im).

During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.

Model: claude-opus-5-5
Harness: Claude Code 2.1.285
Ran: 2026-09-30 15:31:11 UTC · 41 turns
Criteria hash: a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
Full transcript: Download (JSONL, gzip) · every tool call, page read and reply
Run protocol: 2026-09-30-v1
Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.
Human review: pending

Check it with your own agent

Verify this assessment

Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/manus.json.

Or grade it from scratch. See Check any score yourself.

Something wrong or out of date?

Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.

Dispute a finding