Manus Cue is a standalone app for personal agents that Manus launched with Manus 2.0 on 28 September 2026. Each agent comes with its own email address, phone number, wallet and computer. Manus's own description is "Give it a cue, and it gets to work." The agent can send messages, pay within a budget you set, and take your calls and leave you a summary.
Most personal agents are reached only by their owner. An agent with a phone number can be reached by anyone who has that number. That is useful, and it changes the question an approval model has to answer. This post covers what Manus shipped and what that change means. For the other six products in the category, see personal agents in 2026, compared.
What did Manus 2.0 ship?
Manus 2.0 is, in the company's words, "not a version update. It's a new architecture, new products, and new capabilities." Beside Cue, the release includes:
- Remote Control and Computer Use on your own machine, "using the files, browser, and apps you've approved", which keeps working while you are away.
- Cloud Computer, a paid, always-on dedicated environment.
- Automations, triggered by email, calendar, Slack, Notion or ad-performance events.
- Manus Studio, the renamed desktop app, described as "a shared workspace for people and AI".
- Cascade, Manus's own agent harness. In one tested configuration, Manus reports it used 23.2% fewer tokens, finished tasks in 28.2% less time and cost 32% less.
Cue's headline feature is the group chat: "Put several agents in a group chat with a shared goal, and they hand work to each other. You set the direction and make the final call." Manus's examples are ordinary errands, down to scanning a restaurant's QR code so the agent can order or hold your place in the queue. Cue is in early access, free with an invite code, with iOS pending App Store review.
What changes when an agent has a phone number?
An agent that only its owner can message has one source of instructions. Every request is the owner's, so the only question is how much to trust the owner's intent. An agent with a public email address and phone number has as many sources as there are people who know the number: the restaurant, a delivery driver, a recruiter, anyone who sends a phishing email.
Each of those messages is input the agent reads. Anything the agent reads can try to steer it. A caller can say "the owner asked me to confirm the card number". An email can carry instructions hidden in a signature. That is a prompt injection with a phone line, and a budget does not stop it. A budget caps how much can go wrong, but it cannot tell a real request from a forged one.
A message from outside reaches the agent. Either the agent decides on its own, or the request stops and waits for the owner.
What should a reachable agent have to ask?
Once outsiders can reach an agent, three rules follow, and they apply to any agent that other people can message, not just Cue:
- Tag who is asking. An instruction from the owner and one from an outside caller should never look the same to the policy that decides what runs, even if they look the same to the model.
- Outsiders cannot unlock irreversible actions. Paying, sending on the owner's behalf, deleting and reading credentials should stop for the owner whenever the request came from someone else, however plausible it sounds.
- The approval must come from outside the conversation. If the outside party can see or influence the approval, it is not an approval. Meta's Muse shows how: its dialogs come from Sentinel, a separate service, and never pass through the chat.
Manus's announcement says "you stay in control of what it does" and describes spending budgets. It does not yet explain how individual transactions are approved, a gap Runtimewire's coverage also noted. That does not mean the controls are missing. It means they have not been described, and a reader deciding what to connect should wait for them.
How does muti handle requests from other people?
muti is not a personal agent, but requests from other people are its whole premise. It gives the coding agent on your machine a room, and the people you invite send it work. Every request records who sent it. The owner's own requests and everyone else's go through different gates: each invited person has their own permission, read-only, edit or a standing grant, and four action types always stop for the owner whoever asked: pushing to a shared branch, deleting, spending money and touching credentials.
Messages that arrive through Slack are treated as untrusted input by design. Channel membership is never the permission model, and the approval buttons go to the owner's own DM, not to the thread where the request was made. See the Slack bot that asks before it pushes.
The difference from Cue is scope. muti does not give the agent a public phone number: only people you invite can reach it. Each person you let in stays a distinct, named requester, so "reachable" never quietly turns into "trusted".
Frequently asked questions
What is Manus Cue?
Cue is Manus's standalone app for personal agents, launched on 28 September 2026 with Manus 2.0. Each agent has its own email, phone number, wallet and computer. It can message, pay within a budget and take calls, and several agents can share a group chat with a common goal. It is in early access and free with an invite code.
Is Manus still owned by Meta?
No. Meta agreed to acquire Manus for about $2 billion, but Beijing blocked the deal on 27 April 2026, and CNBC reported that it had been unwound by August. Manus is based in Singapore and launched Manus 2.0 and Cue as an independent company.
Can other people talk to my Cue agent?
They can reach it, because it has its own email address and phone number. That is different from sharing it. Cue's group chats bring several of your own agents together, not several people. How the agent treats instructions from outsiders is the thing to check before you connect a wallet.
Is a spending budget enough protection?
A budget limits how much a mistake can cost, but it does not decide whether a request is real. An outside caller who convinces the agent that a payment was authorised can spend up to the limit. Pair a budget with a rule that payments requested by anyone other than you always stop for your approval.
Sources
- Introducing Manus 2.0: manus.im/blog · Cue: cue.im
- The Next Web: thenextweb.com · TestingCatalog: testingcatalog.com
- Runtimewire: runtimewire.com · CNBC on the Meta deal: cnbc.com
- How the category asks permission: allow once, always allow, deny
If other people are going to reach your agent, make sure you are the one who says yes. Give it a room.
公開日