Why I Cancelled My Manus AI Subscription And Built The Better One
Last month I had my credit card out, ready to subscribe to Manus AI. Then I built the better one and this is how you can do it.
TLDR: Github link see below.
If you missed the hype: Manus is an AI agent launched in March 2025 by a Beijing startup called Butterfly Effect. You give it a prompt, and it does the whole thing. Research, code, browser actions, file management, deployment. It topped the GAIA benchmark at launch, got a $500M valuation from Benchmark within weeks1, and Meta acquired it for $2B+ by December2. The pitch was simple: a general-purpose AI that works like a human assistant inside a virtual computer.
$39/month for 3,900 credits. Felt reasonable.
Then a guy named jian on X3 performed what he called a “trivially simple jailbreak.” He asked Manus to show the files in its /opt/.manus/ directory. And it just... complied.
His verdict: “It’s Claude Sonnet. It’s Claude Sonnet with 29 tools. It’s Claude Sonnet without multi-agent.” The whole thing was an E2B sandbox with obfuscated Python scripts wrapping an Anthropic API call.
I put my credit card away. For good :)
What Manus actually is
Co-founder Ji Yichao (Peak) confirmed it. They “employed Claude and different fine-tuned versions of Qwen” and were “internally testing Claude 3.7” after building on Sonnet4. The leaked system prompt is on GitHub for anyone to read5.
Zvi Mowshowitz wrote a full breakdown: “Manus appears to be a Claude wrapper, using a jailbreak and a few dozen tools, optimized for the GAIA benchmark, backed by an influencer-centered marketing campaign.”6
The pricing tells you the rest. A single complex task burns 900+ credits. Your $39 plan covers four or five real projects. Credits don’t roll over. Run out mid-task and it stops. No refund.
One model. No routing. A credit system that feels like gambling. And Mindgard gave their browser extension a security risk score of 100 out of 100, calling it a tool with “characteristics matching Remote Access Trojan definitions.”7
What I built instead
I already pay for Claude Code Max $100 per month (Opus 4.6 through my Anthropic subscription). It has file operations, shell, web search, and multi-agent tools built in. The question: what’s missing?
Five things. I closed all five.
1. Model Routing. Manus sends everything through one model. My setup routes by complexity. Architecture goes to Opus. Tests go to Sonnet. Validation goes to Haiku. If Haiku fails, it escalates to Sonnet, then Opus.
2. Data Priority. My datasource skill enforces a chain: local files first, then MCP servers (Strava, Spotify, GA4), then APIs (Perplexity, Parallel AI), then web search. Model knowledge is the last resort (it is always pretty outdated). The agent never guesses when a real source exists.
3. Context Anchor. Borrowed directly from Manus. Peak Ji wrote about why they rewrite a todo.md after every step: “By constantly rewriting the todo list, Manus is reciting its objectives into the end of the context. This pushes the global plan into the model’s recent attention span, avoiding ‘lost-in-the-middle’ issues.”8 My version: 30 lines max, re-read every 5-7 calls, loaded last on resume. Same fix, no credits burned.
4. Deploy/Expose. Preview: a cloudflared tunnel for instant public URLs, no account needed. Production: auto-routes to Vercel, Railway, or Netlify by stack. Both require explicit approval. Manus had a vulnerability where prompt injection could expose VS Code Server to the internet without consent.9 My approval gate is a hard stop, not a suggestion.
5. User Takeover. When the browser agent hits a login page, payment form, CAPTCHA, or 2FA, it stops. Shows the URL, waits for manual action. Manus tries to power through these, which is how security researchers found data exfiltration paths.10
The most important part
Building this took one afternoon. Not because I’m fast. Because the hard part was already done by Anthropic.
The actual work is writing good instructions. A CLAUDE.md file. Skill definitions. Routing rules. Text files. No infrastructure. No VMs.
Peak Ji: “If model progress is the rising tide, we want Manus to be the boat, not the pillar stuck to the seabed.” Smart framing. But the boat is sitting on someone else’s ocean.
That ocean is Claude. You can sail on it directly.
Is this for everyone?
No.
If you want to type a prompt and get a result without thinking about setup, Manus works. You’re paying for convenience.
But if you already use Claude Code and you’re comfortable editing markdown files, you can build something that does more. For free. Peter Wildeford put it well: “Manus made genuine innovations and seems useful! But it isn’t some massive advance.” I agree. The innovations are real. They’re just not worth $39/month.
Your call.
P.S. Take everything from my GitHub: https://github.com/baranskyi/manus-diy and give it a Star if it's worth it.
Sources
Zvi Mowshowitz, “The Manus Marketing Madness,” Substack, March 10, 2025.
CNBC, “Meta acquires intelligent agent firm Manus,” December 30, 2025. https://www.cnbc.com/2025/12/30/meta-acquires-singapore-ai-agent-firm-manus-china-butterfly-effect-monicai.html
The Decoder, “Chinese AI agent Manus uses Claude Sonnet and open-source technology,” March 2025. https://the-decoder.com/chinese-ai-agent-manus-uses-claude-sonnet-and-open-source-technology/
Leaked system prompts, GitHub. https://github.com/jujumilk3/leaked-system-prompts/blob/main/manus_20250310.md
eesel.ai, “Manus AI pricing: A deep dive into its controversial credit system.” https://www.eesel.ai/blog/manus-ai-pricing
Mindgard, “Manus Rubra: The Browser Extension With Its Hand in Everything,” November 2025. https://mindgard.ai/blog/manus-rubra-full-browser-remote-control
Ji Yichao (Peak Ji), “Context Engineering for AI Agents,” Manus Blog, July 2025. https://manus.im/blog/Context-Engineering-for-AI-Agents-Lessons-from-Building-Manus
Embrace The Red, “How Prompt Injection Exposes Manus’ VS Code Server,” June 2025. https://embracethered.com/blog/posts/2025/manus-ai-kill-chain-expose-port-vs-code-server-on-internet/
Just WOW! Thanks, interesting and helpful.