Researchers found a way around Manus' guardrails and got it to execute a simple email prompt injection attack.