Manus AI Review (2026): The Agent Ships. The Bill Is the Part You Can’t See.

Last updated: June 25, 2026

Manus is a cloud-based AI agent. You hand it a goal, and it plans the steps, browses the web, runs code, writes files, makes slides and images, and can build and deploy a working website, all metered by a credit system. It is not a chatbot you talk to. It is an execution environment you hand work to. The short version of this review: Manus is best understood as rented execution. It can produce and ship real artifacts, but the buyer still has to verify cost, facts, refund eligibility, deployment, and continuity before making it part of how they actually work. This review covers Manus Pro, run over a seven-day trial in June 2026.

The most impressive thing Manus did in a week of testing was build and publish a real website.

I gave it a one-page brief for a made-up product. Six minutes and 276 credits later it returned a live URL on a manus.space subdomain: a hero section, three pricing tiers, a four-question FAQ, a working footer with contact details. None of it was faked. The page loaded.

The most revealing thing it did came from a different test. With web search switched off, I asked the agent to describe its own company. It knew it was built by Butterfly Effect, the studio behind Monica. It did not know, or would not say, that Meta had bought it. It could not tell me its own current pricing. The whole time, the help center I had open carried a banner across the top: “Manus is now part of Meta.”

So here is the review in one line. Manus can build the thing. The harder question, the one every section below comes back to, is whether you control the work after Manus starts doing it.

The capability is real. What you rent it with is the part that is not settled yet.

What Manus actually is

Most tools you have used answer you. Manus acts for you.

You give it a goal in plain language, and it runs a multi-step job on its own cloud machine: searching, clicking through pages, writing and running code, producing files, slides, images, and full web pages. Manus puts the surface plainly on its own site: a web-app builder, an AI slide maker, an image and design workspace, a browser operator that borrows your tabs, a parallel research mode called Wide Research, a mail assistant, and connectors for its API, Zapier, Slack, Telegram, and Line.

The more useful way to frame Manus is as an orchestration layer, not a standalone model subscription. Reuters describes it as an agent framework running on existing large language models, and Manus’s own product pages sell execution surfaces rather than a proprietary model roster. For image and design work, those pages name Google’s Nano Banana Pro and OpenAI’s ChatGPT Image. For the reasoning, Manus’s own Trust Center is specific: its public subprocessor list names Anthropic, OpenAI, and Google as foundational-model providers, all based in the United States, and lists no Chinese model vendor.

That framing matters for one reason. When you pay Manus, you are not paying for a smarter brain. You are paying for the wrapper: the planning, the cloud computer, the tool execution, and the credits that meter all of it. Everything in this review is about whether that wrapper gives you enough control over cost, output, and ownership to depend on.

Pricing and credits, verified

Manus runs on credits, not seats or per-message caps. You pay a base subscription, you get a pool of credits, and every action the agent takes burns some of them.

Here is the current structure, checked against Manus’s own help center and pricing in June 2026. Treat the exact numbers as a snapshot and recheck the live pricing page before you pay, because Manus itself says the live page is the source of truth, and several high-ranking reviews still quote retired plan names like “Standard” and “Extended.”

Two credit rules matter more than the headline price.

Monthly credits do not roll over. Whatever you do not spend in a billing cycle is gone at reset. Only separately purchased add-on credits carry over, and only while your subscription stays active.

Daily refresh credits only work on the weakest mode. Free and paid accounts get a daily top-up that refreshes to 300 at 18:00. Manus’s help center is explicit that these daily credits can be used only for Manus 1.6 Lite. The moment you run real work on Manus 1.6 or Max, you are spending your finite monthly pool.

That second rule is the first place the sticker price starts to understate the operating cost. A new user looks at “300 credits a day” and feels covered. In practice that daily allowance feeds the one mode you will use least.

There is one more gap worth seeing before you start the trial. The $40 Pro tier advertises 8,000 monthly credits. When I started its seven-day trial, my account did not show 8,000 of anything. The monthly credit line read 0 of 8,000, and the only trial grant in my history was a single entry for 500 credits on the day the trial began. The 8,000 is what you receive once billing starts, not what you get to test with.

The three modes, side by side

Manus Pro gives you three agent profiles: Manus 1.6 Lite, Manus 1.6, and Manus 1.6 Max. The naming implies a simple ladder with Max at the top. To see what the ladder actually buys, I ran the same prompt, a comparison of five AI tools’ paid plans, through each mode and read the credit meter after every run.

Read the meter against the output and the ladder breaks.

Max cost about three to four times what Manus 1.6 did on the identical task, finished a little faster, and handled the buyer-facing facts worse. Lite was the cheapest and the least trustworthy. The mid mode, 1.6, gave the best result for a fraction of Max’s burn.

One same-prompt test is not a benchmark, and on a complex build Max may well pull ahead. I am not claiming Max is the worst mode. I am saying the price signal did not map to the quality signal, which means the most expensive profile is not a safe default. Pick the mode for the job, and do not assume that paying more buys you more reliable facts.

Paying more for a top tier that does less is a pattern. Grok’s $300 mode could not build a file at all.

You can’t see the cost coming

Here is the thing that should shape how you budget for Manus.

You cannot, in the workflow we tested, see what a task will cost before you run it. And Manus’s own documentation does not tell one story about why.

One Manus docs page, in its pricing section, says the dashboard provides estimates before you start a task and that you can review similar past tasks to gauge the cost. A help center article titled for exactly this question, “Is there a way to check how many credits a task will cost before I begin?”, says the opposite: that Manus recognizes users want real-time visibility and pre-task estimates, that its product team has flagged this as a key area for improvement, and that it is working toward a solution. The same article then pivots into a section on AI hallucinations, warning that Manus can generate information that is incorrect or fabricated and that this matters for interpreting its responses.

Read those two pages together and the answer to “can I see the cost first” is worse than a plain no. It is: not yet, and if the agent tells you a number, treat it as something it may have made up.

Both pages are live right now. They contradict each other.

In my testing the help center was the accurate one. A confirmation gate appeared on the very first task of the session and then never again. Every run after it, including a 274-credit Max job, started the moment I hit go, with no number shown first. The dashboard that does exist, under Settings and Usage, is a record of what you have already spent. It tells you the cost after the credits are gone, not before.

Third-party write-ups describe the same wall from the outside. Several put a single complex task in the range of several hundred to a thousand credits, and an overnight autonomous run far higher, with no upfront figure and no real-time alert when a task is burning faster than expected. On the $20 plan, a few hundred credits is a real slice of a 4,000-credit month spent on a single job you could not price in advance. An agent that can’t tell you its own costs is a pattern, not a one-off. With Ahrefs’s Agent A, a $99 sticker hid a realistic $827 bill the agent never surfaced.

You can manage this. You can run small, watch the meter, and build your own cost model from your usage history. But that is you doing the estimation Manus says it has not built yet, by hand, on every task. For a manager signing off on team spend, “roughly whatever the agent decides to consume” is not an approvable line item.

A task can fail you without failing

The refund policy is where the credit system gets sharp, and Manus says two slightly different things about it.

One help center page, on how to apply for a refund, invites you in. It says you can submit a request when you hit a technical error or are unsatisfied with the result, share the task link, and Manus will review the conversation and refund the appropriate credits after verification. That sounds broad.

A second help center page, the dedicated credit refund policy, is where the line actually sits. It says Manus cannot issue refunds for anything outside a platform malfunction, and it names what that excludes: issues from your own instructions, subjective satisfaction with the outcome, and the inherent limitations of AI. Refunds center on verifiable bugs, platform malfunctions, and tasks that stop and deliver nothing. Every request is reviewed by a specialized AI agent trained to read task execution logs.

So the invitation and the eligibility do not point the same way. You are welcome to report a bad result. The refund is decided on whether the platform malfunctioned, not on whether the agent did the job.

A task can fail you without failing by Manus’s definition.

If the agent completes a task, spends several hundred credits, and hands you a confidently wrong table or a weak design, the platform may well have processed everything correctly. The system worked. The output did not. You can report it, and you may still pay for it.

That gap shows up in public sentiment. Manus’s Trustpilot page sits around 1.2 out of 5 at the time of writing, and its Trustpilot and G2 reviews skew heavily toward billing and refund complaints: credits burned on failed development work, refund requests met by an automated reply, charges disputed through card chargebacks. These are user reports, not Manus’s stated policy, and FSR has not reproduced any individual case. But the no-rollover rule and the AI-reviewed refund path are confirmed in Manus’s own documents, and the volume of aligned complaints is hard to wave off. The first reviewer of your refund is the same kind of system whose execution is in dispute.

Credit-and-refund terms catching buyers out is not unique to Manus. With Zebracat, the refund guarantee, the terms, and support all said different things.

The same prompt, different facts

The mode test surfaced a second problem that has nothing to do with which mode you pick.

Run the same prompt twice and you can get different facts back.

In my comparison runs, the competitor details shifted between attempts. One run reported a 30-day free trial for a tool; another reported no trial at all for the same tool. Manus produced clean, confident tables every time. The tables just did not agree with each other on details a buyer would actually act on.

This is not a Manus-specific defect, and it is worth being fair about it. Research has documented for years that large language models are non-deterministic, meaning the same question can yield materially different answers across runs. One widely cited study ran several models on fixed tasks ten times each and found accuracy swinging by up to 15 percent, with no two runs producing identical text. Another offers the clean example of asking which country has the highest life expectancy and getting one answer on one run and a different one on the next. Newer work on tool-using agents finds that an early mistake propagates forward through the later steps, which is exactly the failure mode of a multi-step agent that searches, scrapes, and writes in sequence.

For Manus the practical takeaway is narrow and firm. Anything factual it hands you, competitor pricing, trial terms, market numbers, is a draft to verify, not a source to cite. The agent is a strong researcher and a poor final authority.

Where it earns its keep: the build

After three problems in a row, this could read as a takedown. The build test is the reason it is not one.

The strongest result of the week was not research. It was deployment.

I gave Manus a bounded brief: a one-page landing site for a fictional product, with specific sections. In Max mode it built the page and put it live on a public manus.space address that actually opened. The brief asked for a hero, three feature cards, a three-tier pricing block, a four-question FAQ, and a footer with contact and policy links. All of it was there. This was not a dead preview link or a half-finished mockup. It shipped.

The page loaded. That part is real.

What it produced is a scaffold, not a finished brand. The structure, the sections, and the deployment were strong. The copy read like AI copy, the kind of breathy lifestyle lines that need a human pass before anyone sees them. That is a general limit of AI site builders, not a Manus-specific flaw, and it is easy to fix. For a prototype, an internal page, a demo, or a fast first draft of a real site, this is a useful tool that does in minutes what would otherwise eat an afternoon.

Give Manus a clear, bounded job with a defined finish line, and it delivers. The trouble starts at the open-ended end, where it cannot price the work, and at the back end, where you find out how much of the result is actually yours.

You own the file, not the deployment

Ask Manus who owns what it makes, and the answer is clean. Ask what you can do with it, and the answer gets narrower.

Manus’s help center is direct on the legal point: you own everything you create, websites, images, videos, slides, and “Manus does not claim ownership of your Input or Output.” You can use it commercially. So far, so good.

Owning the copyright is not the same as controlling the website.

The same help article that grants you ownership also notes that Manus uses your content to run the service, and it gives hosting your site as the example. The page I built lived on a manus.space subdomain, on Manus’s infrastructure, as part of Manus’s operation. Storing and deploying that output did not cost extra credits, which is a small point in Manus’s favor. But removing the “Made with Manus” badge was a paid feature in testing, and the badge returns if the subscription lapses. Manus even adds, in the same breath as granting ownership, that AI output may not be unique and may not be protectable under IP law at all.

So the honest version is layered. You own the copyright to the output. You do not, by default, own the running, branded, hosted thing the agent shipped. It is the same split we found with Base44: you own the code, but not the runtime it runs on. For a throwaway demo that does not matter. For a client deliverable or a production asset, the questions you need answered before you rely on it are concrete: whether you can export the full source, point a custom domain at it, remove the vendor badge permanently, and keep the site live if you stop paying. I did not get to verify export, custom-domain, or post-cancellation behavior in this trial, so treat those as open questions.

The questions your procurement team will ask

Manus is not a paperwork-empty consumer toy, and it would be unfair to imply otherwise. Its Trust Center, monitored through Vanta, lists SOC 2 Type 2, SOC 2 Type 1, ISO 27001, and ISO 27701, with attestation letters and certificates referenced for each. That is real compliance presence, and more than some rivals show.

The gap is in what a buyer can actually pull without a sales call.

More of the picture is public than I first credited. The Trust Center carries an open subprocessor list, and it is specific: eleven processors, every one based in the United States. The foundational-model providers are Anthropic, OpenAI, and Google. The infrastructure runs on Google Cloud, Microsoft Azure, AWS, and Cloudflare. Billing and payments go through Stripe and RevenueCat, and support, security, and notifications use Intercom, hCaptcha, and Twilio. That is a clear data-handling map, and it is the real answer to the residency question: your data touches a US processor stack, with no EU-region processor listed.

What stays behind the gate is the paperwork. The SOC 2 and ISO attestation reports and certificates require a request through the Trust Center, so a reviewer cannot self-serve them. The data processing agreement and the master services agreement are not posted; at least one third-party guide notes the master services agreement has to be requested during procurement. There is no standalone data-residency commitment beyond what the all-US subprocessor list implies.

On training, Manus does make a stated commitment: it says it uses only aggregated or de-identified data to improve its services, and the Team plan adds a data-training opt-out. That is more than nothing. It is also not the same as a published, auditable data map.

None of this is evidence of a violation, and I am not going to pretend to settle a GDPR or AI Act question that only primary regulatory review can answer. What I can say is narrower and still useful. Manus is more open about who handles your data than most agents, and that openness is the bad news for an EU buyer: the named stack is entirely US-based. The contracts and the actual reports still have to be requested directly.

Knowing exactly where an agent sends your data is rarer than it should be. We had to trace it ourselves for PewDiePie’s Odysseus workspace.

The owner above the page: Meta, Beijing, and continuity

There is a risk in Manus that has nothing to do with the product and everything to do with who controls it. As of this writing, that question has no settled answer.

The short timeline, from reporting:

In December 2025, Meta acquired Manus for a figure the Wall Street Journal put at over $2 billion, and integrated it. In January 2026, China opened a national security review of the deal. In April 2026, China’s National Development and Reform Commission ordered the acquisition unwound on national security grounds, the first time the regulator has both published such a decision and forced the reversal of a closed transaction. Reporting indicates the founders were summoned to Beijing and barred from leaving the country, and that they are exploring raising around $1 billion to buy Manus back. In June 2026, an internal Meta memo seen by Bloomberg reportedly told staff that Meta is winding Manus down, firewalling it from internal systems, moving existing projects onto Meta’s systems, and starting no new work on the platform.

Read that against the product and you get the strange picture this review opened with. Manus’s public site still displays “Manus is now part of Meta,” and its footer carries a 2026 Meta copyright line. The agent, asked about itself, did not know the deal had happened. And the service is still running. I built a working site on it the same week the winding-down memo was reported.

So this is not a “the product is dead” warning, and it is not a “Chinese app, stay away” warning either. Both of those would be lazy and wrong. The accurate warning is about continuity. If you sign up for Manus today for anything beyond a quick experiment, you cannot be sure who will own the service, who is responsible for your data and your hosted sites, or which roadmap survives a quarter from now. For a one-off task that is a non-issue. For a workflow you intend to build on, it is the single biggest reason to wait.

The alternatives, by what you control

“Manus alternatives” usually gets answered with a feature grid. That misses the point. The reason to leave Manus is not a missing feature. It is a control problem: cost you cannot see, output you do not fully hold, a vendor whose future is unsettled. So the comparison that matters is what you control after the agent runs.

Read down the control column and each choice trades one problem for another.

Genspark is the nearest direct competitor: the same orchestration-over-many-models design, the same complaints about credits draining on complex tasks, the same billing friction in its reviews. Switching to it does not fix the control problem. It is the same bet with a different vendor, and right now a more stable one, since Genspark spent April 2026 wiring its agents into Microsoft 365 rather than being ordered unwound.

Cursor is narrower. It is a coding agent that runs in your editor on your repository, so the artifact is portable by default: the code is yours, in your own version control, with a real review loop around it. Its Enterprise tier carries the audit logs and access controls a procurement team can actually point at. It shares Manus’s one unfixable trait, token cost you cannot fully predict, but it solves the ownership question that Manus leaves open. If your real job is building, this is the stronger tool.

OpenClaw is the control-maximal end. It is an open-source, self-hosted agent that runs on your own hardware, so your data never leaves and there is no vendor whose future you have to underwrite. The catch is that control moves the cost and the risk onto you. Its own creator, the developer Peter Steinberger, reported spending roughly $1.3 million in OpenAI tokens in a single month running about a hundred agents on the project, which is the most honest public number anywhere on what autonomous agents actually cost at scale. The project has also logged security advisories at many times the rate of the Linux kernel. You get full ownership and full transparency, and you pay for both in money and maintenance.

There is a fourth path worth naming in passing. Because Manus is an orchestration wrapper over models you can rent directly, a technical team can build the same workflows straight on the Claude or OpenAI APIs, where every token is priced and nothing is hosted by a third party. That is the most control you can buy, and the most engineering you have to do for it.

Who should use Manus, who should wait, who should skip it

Use Manus if you are an individual or small team that needs fast research drafts, quick scaffolds, slide decks, or one-off web builds, you can absorb credit swings as an experiment cost, you will run a human pass over anything factual, and you are fine moving the output into something you control. Use it where the output is disposable, the data is non-sensitive, and the value is speed rather than ownership.

Wait if Manus would become part of a recurring client workflow, a team rollout, or anything where you have to predict the cost per job and explain it to someone else. The reasons are the ones above: cost you cannot see in advance, refunds drawn at platform faults, a deployment you do not fully control, and an unresolved question over who owns the company. The first successful demo will look great. The questions that decide it all land after the demo.

Skip it, for now, if you work in a regulated field, handle client-confidential or personal data, or sit in an organization whose procurement requires a signed data processing agreement, clear EU data residency, and the actual audit reports before sign-off. The subprocessor list is public, but it is entirely US-based, the reports and the DPA are gated, and the continuity situation makes a long-term commitment hard to underwrite.

FAQ

How we tested and what we didn’t

FSR ran Manus Pro through a seven-day trial in June 2026, on a desktop account in Japan. The hands-on tests were a same-prompt comparison of all three modes (Lite, 1.6, Max) on a five-tool pricing-research task; a no-search prompt asking the agent to describe its own company, model, owner, and pricing; and a bounded landing-page build in Max mode that was deployed to a live URL. Credit costs and run times in this review are read from the account’s own usage history.

Pricing, credit rules, the two refund pages, the pre-task-estimate contradiction and hallucination note, the ownership terms, the training statement, and the Trust Center badges and public subprocessor list (trust.manus.im) are taken from Manus’s own help center, documentation, and trust portal, verified in June 2026. The foundational-model providers named here, Anthropic, OpenAI, and Google, come from that subprocessor list, not from third-party teardowns. The acquisition, the unwind order, and the reported winding-down are sourced from Reuters, the Wall Street Journal, CNBC, and Bloomberg-based reporting, and are labeled as reported. Competitor details for Genspark, Cursor, and OpenClaw are vendor-reported and dated; Cursor pricing was checked on June 9, 2026, and the others in June 2026. The OpenClaw token-cost figure is reported, not independently audited. Competitor pricing the Manus agent produced was not used as fact. The points on non-determinism come from peer-reviewed and preprint research and are framed as an emerging body of work.

FSR has no affiliate relationship with Manus. This review earns nothing from your decision either way.

What we did not test, and you should not read into this review: a 30-day production deployment; hands-on use of Genspark, Cursor, or OpenClaw; whether you can export full source or attach a custom domain to a built site; whether a public site stays live after cancellation; and a controlled reproduction of the failed-task refund and downgrade behavior that users have reported. Pricing, terms, and the Meta situation are all volatile. Recheck them before acting. The next recheck on pricing, refund terms, and the Meta status is due within 30 days of this date.

The verdict

Manus is a real execution tool, and on bounded work it is a good one. It researched, it built, and it shipped a live website in a single afternoon. If the question were only whether it can do the work, the answer would be a straightforward yes.

That is not the question a serious buyer is asking.

The question is whether you can run this thing as part of how you actually work, and there the answer is more guarded. You cannot see what a task costs before you spend it. The refund line is drawn at the platform’s faults, not your failed outcomes. The same prompt can hand back different facts. The site it ships lives on its hosting, behind its badge. And the company itself is mid-unwind, with its owner reportedly winding it down and its founders reportedly trying to buy it back.

Tier B. Capable agent, rented execution. Use it where the output is disposable and the speed is the point. Wait before you build a workflow on it, and verify the cost, the contracts, and the continuity before you do.