How to Evaluate the Manus AI Agent in October 2026: Owner, Cost and Risks

The Manus AI agent is a hosted agent from Butterfly Effect, a Singapore company with Chinese roots, and as of October 17, 2026 Meta does not own it. Meta announced the purchase in December 2025 in a deal reported at $2 billion, Beijing ordered it unwound in April 2026, and Manus announced an independent round of more than $500 million on October 8.

You pay in credits, Manus's usage currency: $0 on the free plan, then $20, $40 or $200 a month. This guide takes about 30 minutes to read and ends with a one week trial to run on your own tasks.

Before you start

• A Manus account. The free plan covers the first runs in Step 6, but the $40 plan lists a 7 day free trial and the $20 plan lists none.
• Three real tasks you repeat every week, such as a research brief, a competitor table or a lead list. A trial on invented tasks tells you nothing.
• A budget you are willing to lose. $20 is enough for a first month.

Every price and plan below was read from the vendors' own pages on October 17, 2026. Those pages change often, so treat the dates as part of the facts.

Step 1: Check who owns Manus after Meta

Ownership decides whose terms you accept. Manus went from a Meta deal to a blocked deal to a standalone company in about nine months.

1. December 2025. Meta announced it had acquired Manus, a company founded in China that had moved to Singapore. Terms weren't disclosed, but the Wall Street Journal reported more than $2 billion, per CNBC's December 30 report.
2. April 27, 2026. China's National Development and Reform Commission asked the parties to withdraw the deal. It said it had decided to "prohibit foreign investment in the Manus project", as CNBC quoted in October.
3. August 11, 2026. Manus told users it would return to operating as an independent company, and that data some users generated on or after December 29, 2025 would be deleted on August 23 and 24 unless backed up.
4. October 8, 2026. Manus's parent, Butterfly Effect, said it raised more than $500 million. CNBC reported that Boyu Capital and IDG Capital led the round, with Tencent, HSG and ZhenFund following on. The valuation was not disclosed, though Bloomberg had reported a $4 billion target.

So Butterfly Effect owns Manus, its shareholders include Tencent, and Manus says it resumed independent operations earlier in October. If someone asks whether Manus is a Meta product, the answer today is no. But read the terms and privacy policy you accept, and if you used Manus between the deal announcement and August, check whether your account fell into the data deletion group.

Meta went on to launch its own agent, Muse, in early September, which CNBC says is modeled on the open source agent OpenClaw. I covered its design in Meta's Muse and the personal AI agent security problem.

Step 2: Learn what the Manus AI agent does and does not do

Manus runs each task in a virtual machine sandbox, as its own engineering post describes. A sandbox is an isolated computer the agent works in, separate from yours. You give it a goal, it plans, then loops through actions inside that sandbox until it has a report, deck, spreadsheet or deployed site.

That July 2025 post also explains the loop. The agent keeps a todo.md file in the sandbox and rewrites it as it goes, and it treats the file system as external memory instead of cramming everything into the prompt. That post put a typical task at around 50 tool calls. It's over a year old, so don't size anything from it.

Features Manus's documentation lists as current in October 2026:

The limits are below.

• Closed source and hosted. I found no self hosted option in its docs. You can't read its code or swap its model. Even with My Computer, Manus's help article says planning still runs in its cloud.
• Tiers carry Manus's names. Free gets only Manus 2.0 Lite in Agent Mode; paid plans add Manus 2.0 and Manus 2.0 Max. I couldn't verify from Manus's pages which underlying models those tiers use, so I won't guess.
• No reliable bill before the task. See Step 3.
• It still makes mistakes. Manus's help center has a section on hallucinations. Check every number before it reaches a client.

Step 3: Work out what the credits cost

Credits are Manus's usage currency. They are spent on language model tokens, the virtual machines the agent runs in and any third party APIs, per the help center's credit rules. Here are the plans from the Manus pricing page on October 17, 2026. The last two columns are my arithmetic from a script.

The price per credit is flat at $5 per 1,000 across all three paid tiers, so a bigger plan buys capacity, not a discount. The page says annual billing saves 17%, so that column is calculated, not printed by Manus. The Team plan starts at $20 per seat a month and, per the pricing help article, is where the training data opt out and SSO live. Paid tiers allow 20 concurrent and 20 scheduled tasks; Free allows 1 and 2.

Free users get 300 refresh credits a day, capped at 1,500 a month, usable only with Manus 2.0 Lite.

• Monthly credits don't roll over, even if you upgrade mid cycle.
• Spending order: event, daily, monthly, add on, then free credits.
• Your balance can go below zero because Manus deducts an action's cost at the start of the next action. You can't start a new task until you're back above zero.
• Tasks that fail on Manus's side get the consumed credits refunded. Stored outputs and deployments cost nothing.

Estimates are murky too. A December 2025 help article says Manus can't judge credit use itself and that pre task estimates are planned. I couldn't check the current dashboard from outside an account, so measure instead.

Manus doesn't publish credits per task, so I can't give you a real cost per report. The arithmetic is simple though. At $5 per 1,000, a task that burns 300 credits costs $1.50 and the $20 plan covers 13 a month. One that burns 1,000 costs $5 and the plan covers four. Those task sizes are assumptions, not measurements, and Step 6 replaces them with yours. To compare against an API based build, the AI agent cost calculator does the same sum.

Step 4: Decide what an agent with your logins can get wrong

The sandbox protects your laptop. It also holds every login you give it. Code the agent writes runs in a cloud machine, not on your computer, which is real sandboxing. But once you connect Gmail, Drive or a CRM, that machine holds live sessions, and whatever can steer the agent can use them. Connectors are the links that let an agent act inside your accounts.

Two security write ups show why. Both come from security vendors, so read them with that in mind.

• SilentBridge, February 2026. Aurascape described three zero click prompt injection variants in Manus, each scored CVSS 9.8 by the researchers (CVSS is the standard 0 to 10 severity score, and 9.8 is critical), delivered through a web page, a search result or a document. Their timeline says they reported it in September 2025 and Manus deployed mitigations in November 2025.
• Shared project instructions, September 2026. CodeAnt reported that a project owner's instruction field loaded as trusted configuration into every member's agent, which let them run code in another member's sandbox after an invite was accepted. They reported it to Meta on May 10. By their timeline Meta closed the case on August 27, CodeAnt filed again on September 4, and the fix came on September 16, 2026.

Both are fixed according to their authors. The pattern isn't going away: this is indirect prompt injection, where anything the agent reads can carry instructions. My rules for any hosted agent:

1. Start with no connectors. Add one at a time, only when a task needs it. That's least privilege applied by hand.
2. Give the agent its own accounts. A throwaway mailbox and a test drive folder beat logging your main accounts into its cloud browser.
3. Prefer approval for anything that writes. The desktop app asks you to allow each local command, once or always. Choose once until a command has earned more.
4. Don't join a shared project from a stranger. The September finding turned that single click into code execution.
5. Save the Browser Operator for sites that need your real login. Manus says you authorize each session, all actions are logged, and closing the tab stops it.

For the same problem in other agents, see OpenClaw's security record and why merging Claude Cowork into chat removed a permission prompt.

Step 5: Pick an alternative by what you need

Manus fits when you want a hosted general agent with a polished interface, you're fine paying per credit, and the data isn't sensitive. Switch when you need control, a fixed bill or an audit trail. Prices below come from each vendor's own pages on October 17, 2026.

OpenClaw

OpenClaw is MIT licensed and, per my OpenClaw explainer, run by the independent OpenClaw Foundation with no paid tier or hosted service. You bring a model and talk to it through WhatsApp, Telegram, Slack and other chat apps. You patch it yourself and its security history is long, so read the security section of that explainer first.

Hermes Agent

Nous Research's Hermes Agent is also MIT licensed. Its README lists a terminal interface, a gateway to Telegram, Discord, Slack, WhatsApp, Signal and email, a learning loop that writes and refines skills, and seven terminal backends: local, Docker, SSH, Singularity, Modal, Daytona and Vercel Sandbox. The backend choice gives you Manus's isolation idea on infrastructure you pick.

Claude Cowork and Claude Code

Anthropic's pricing page says Cowork has merged into Claude itself, rolling out to Pro and Max. Pro is $20 a month, or $17 on the annual plan, and includes Claude Code. Cowork works in folders and tools you choose and keeps running when your laptop is closed. I'd pick it over Manus when the deliverables are files on your machine, and Claude Code when the task is software.

OpenAI

OpenAI's current agent surface is ChatGPT Work and Codex, which share usage and pricing. Plus is $20 a month and Pro comes in $100, $200 and $500 tiers. OpenAI also describes "dots", an always on cloud agent with its own computer and browser, rolling out gradually to eligible accounts. Check access before planning around it.

n8n agents

If the job repeats and the steps are known, an agent is the wrong tool. n8n's plans include an AI Agent node, MCP support and human approval for tool calls, and the self hosted Community Edition is on GitHub. Cloud plans are priced per workflow execution. The page showed euros when I checked, so I'm not quoting a converted price. My n8n agent architecture guide covers the pattern I use.

Step 6: Run a one week trial on your own tasks

1. Write the pass rule first. For each task, write two lines on what a good result looks like, for example: every price has a source link and five spot checks match.
2. Run each task on the free plan. Note credits before and after from the dashboard. Free runs only use Manus 2.0 Lite, so a weak result isn't final.
3. Repeat on the $20 plan, or the $40 plan's 7 day free trial, with the same prompt. Record credits used, minutes you spent checking and what you had to fix.
4. Do one sensitive task last, with a throwaway account. If it can't be done without connecting a real account, that's your answer for now.
5. Divide. Total cost, including your checking time, divided by tasks that passed. Compare it with the same task in an alternative from the table.

If the numbers favor a custom build, my guide to building your own AI agent compares three self hosted stacks.

Troubleshooting

The balance shows a negative number

That's expected. Manus deducts each action's cost at the start of the next one, so the last action can push you under zero. It clears at the next refresh, and you can't start a task until you're above zero.

Credits drain fast on a long conversation

Manus's help center says more context to carry means higher cost per step. Its advice is to split big jobs into smaller tasks and state your requirements precisely at the start, instead of correcting across a long thread.

Data generated on or after December 29, 2025 went missing

That date comes from the August separation notice. Affected users could back up until August 23, 2026 and restore from August 25. If you missed the window, contact Manus support. I can't tell from public pages whether late restores are possible.

Add on credits stopped working

The help center says they go inactive when your account moves to Free or the subscription lapses. Keep a paid plan active while you hold them.

Going further

A hosted agent suits one off research and prototypes. It fits badly when you need a fixed monthly bill, data kept where you choose or an audit trail you own. For those cases I build agents on the client's own stack through AI agent development. Whichever tool you pick, check the owner and the terms again in a quarter.

Frequently asked questions

Who owns Manus now?

Manus is developed by Butterfly Effect, a Singapore company founded in China, and Meta no longer owns it. China's planning agency ordered Meta's reported $2 billion deal unwound in April 2026, and Manus raised more than $500 million in October 2026 from Boyu Capital, IDG Capital, Tencent, HSG and ZhenFund.

Is the Manus AI agent free?

There's a free plan with 300 refresh credits a day, one concurrent task and Manus 2.0 Lite only. Paid plans on the pricing page on October 17, 2026 are $20 a month for 4,000 credits, $40 for 8,000 and $200 for 40,000. A Team plan starts at $20 per seat per month.

Is Manus safe to connect to my email?

It's safer with a throwaway account and manual approvals. Researchers reported prompt injection flaws in Manus in 2025 and 2026, and say Manus fixed them. The same attack class affects most agents, so grant the fewest connectors you can and never accept shared projects from strangers.

Can I self host Manus or use it as open source?

No. Manus is proprietary and runs in the vendor's cloud, even when its desktop app works on your files. If you need to self host, look at OpenClaw or Hermes Agent. Both are MIT licensed and let you choose the model and where the agent runs.

What is the best alternative to Manus?

It depends on the job. OpenClaw or Hermes Agent suit people who want control and a low software cost. Claude or ChatGPT suit people already paying $20 a month for them. n8n suits repeatable workflows that need approvals. Run the one week trial in Step 6 before committing to any of them.