What the Meta–Manus Unwind Means for Anyone Running AI Agents
Meta bought Manus for $2B, Beijing blocked it, and the deal was unwound. What it means if your AI agent vendor changes hands and the three questions to ask before you grant access.
6 min readby Prithvi
A $2 billion acquisition that lasted six months
In late December 2025, Meta acquired Manus, the Chinese startup behind one of the first general-purpose AI agents, in a deal reported at over $2 billion. By June 2026 it was being taken apart.
| Date | What happened |
|---|---|
| December 2025 | Meta acquires Manus in a deal reported at over $2 billion (Bloomberg). |
| April 2026 | China's regulators block the deal after a months-long probe (TechCrunch). |
| June 2026 | Meta moves to unwind the deal, cuts Manus off from internal systems and tells staff to sunset the platform (TechCrunch). |
| August 2026 | Manus announces its return to independent operations, with certain users' data scheduled for deletion as part of the separation (Manus: A Note to Our Users). |
The interesting part is not the regulatory fight. It is that for six months, a large number of people were running an AI agent whose ownership, data jurisdiction and continued existence were all actively in question — and most of them had no way to know.
An agent is not a SaaS tool, and an agent acquisition is not a SaaS acquisition
When a SaaS vendor changes hands, the question is what happens to your stored data. Unpleasant, but bounded. You export, you migrate, you move on.
An agent is different in three ways that matter when ownership changes.
It holds credentials. To send email on your behalf it has a token for your mail provider. To update a record it has write access to your CRM. Those tokens do not belong to the agent — they belong to you, and they are sitting inside a company whose owner, legal jurisdiction and data-handling policy just changed without your involvement.
It takes actions, not just answers. A stored document is inert. A running workflow is not. If an agent is mid-sequence when a platform is sunset — drafts queued, approvals pending, a chain of steps half-complete — there is no clean export for a process that was interrupted. You inherit a state, not a file.
It accumulates context you cannot see. Agents work by building up a picture of your business: which accounts matter, how your approvals run, what your team has decided before. That picture is derived from your data but it is not your data, and nothing in a standard export covers it. When Manus split from Meta, reports described user data being deleted in the process. Whatever that covered, the people relying on it did not choose the terms.
None of this requires anyone to have behaved badly. The Meta–Manus deal was undone by a regulator on the other side of the world, for reasons that had nothing to do with any individual customer. That is the point — the risk arrived from a direction no buyer was watching.
Three questions to ask before you grant an agent access
These are worth asking of any vendor, including us. A vendor that cannot answer them specifically is telling you something.
1. Where do our credentials live, and what happens to them if you are acquired?
Not "is it encrypted" — everyone says yes. Ask who can mint a token against your systems, whether credentials are held in your infrastructure or theirs, and whether an acquirer inherits that access automatically. If the answer is that tokens sit in the vendor's cloud, then your access control is only as stable as their cap table.
2. What jurisdiction governs our data, and can that change without us agreeing to it?
Data residency is usually discussed as a compliance checkbox. Manus made it a live question: the deal was blocked by Chinese regulators, and the unwinding was driven by a government's demand, not a customer's. Ask where data is processed, which regulator has reach over it, and what contractual notice you get if either changes.
3. If you shut down tomorrow, what happens to work that is in flight?
Most vendors can answer the data-export question. Far fewer can answer this one. Ask what happens to a workflow that is mid-execution, whether pending approvals survive, and whether you get a record of what the agent did on your behalf — an audit trail you keep, not one you request. If the answer only covers stored documents, the vendor is thinking about an agent like a filing cabinet.
The autonomy question this actually raises
The usual argument about agent autonomy is about capability — can the agent be trusted to get the task right. Manus reframes it as a question about dependency.
An agent that acts autonomously is an agent you have stopped watching. That is the entire value proposition, and it is also the exposure: the less you observe, the less you notice when something underneath changes. For six months, Manus users had an autonomous agent operating against their accounts while its ownership was contested in a regulatory process none of them were party to. The agent kept working. Nothing in the product surface would have told them.
The counterweight is not less capability. It is governed execution — the agent does the work, and the consequential steps stop at a point a human passes. That sounds like friction, and it is, in the same way that a signature on a wire transfer is friction. The question is which actions deserve it.
A useful line: anything reversible and internal can run unattended. Anything that leaves the company — an email sent, a record changed in a system of record, money moved — stops for approval. That division does not slow an agent down much in practice, because most of what an agent does is gathering, drafting and preparing. It mainly changes what happens on the day something goes wrong, or the day your vendor's situation changes without warning.
How we answer those three questions
We built Libra around the assumption that a company should not have to trust its agent vendor's corporate stability.
Credentials. You choose which tools an agent can reach and what it is permitted to do with each. Permissions are scoped per agent, not granted wholesale at the workspace level.
Jurisdiction. Libra deploys to our cloud, your VPC, or fully self-hosted. On the latter two, your data and your credentials never leave infrastructure you control — which makes the question of who owns us considerably less interesting to you.
Work in flight. Agents stop at the approval points you set before anything consequential happens, and every action an agent takes is recorded in an audit trail that lives in your workspace.
If you are weighing an autonomous agent against a governed one, we wrote up the comparison directly: Manus alternatives. For the longer treatment of how to run agents in an organisation, see AI agent governance and AI agent security.
Watch the full breakdown on our channel, where we walk through the Manus timeline and what changed for agents like Cue, Instinct and Muse.
