Manus and the Product-Layer Cost of Reversing an Agent Acquisition

In April, China's foreign-investment security review office, which sits inside the National Development and Reform Commission (NDRC), ordered Meta to reverse its completed acquisition of Manus. The public order is one sentence long. The acquisition is prohibited, and the parties must revoke the transaction. It names no price, gives no rationale, and sets no IP terms.

The order is not the useful part. Over the following five months, Manus published a run of help center documents walking users through backup, deletion, and restoration of their accounts, tasks, connectors, subscriptions, and hosted projects. Read in sequence, they are the most detailed public record we have of what it costs, at the product layer, to reverse an acquisition of a live agent platform. That cost is higher than anyone modeling agent M&A risk has been pricing in.

What was entangled

Manus runs a general-purpose agent platform. Users assign multi-step tasks, and the system executes them across connected applications. Its integration surface covers Gmail, Google Calendar, Slack, Notion, GitHub, Outlook, Shopify, Linear, monday.com, Supabase, PostgreSQL, custom MCP servers, and API endpoints. It also offers a persistent Cloud Computer, a full Ubuntu VM that keeps files, software, and running processes between sessions, and it hosts deployed web projects with custom domains, certificates, and DNS.

Meta closed the acquisition December 29, 2025. By the time the NDRC acted four months later, Meta's ownership had worked its way down from the corporate layer into user identity, billing, task history, connector authorizations, and hosted infrastructure. The separation process shows how far down it went.

Three user classes, three depths of coupling

Manus defined the affected window as December 29, 2025 through August 23, 2026. Anything created or modified inside that window was subject to deletion. Users were sorted into three classes:

Type A: account created before the acquisition, no changes to email or user information afterward, no active post-acquisition subscription. These users kept their accounts but lost task data and connectors created during the ownership window.

Type B: same as Type A, but with a subscription purchased after the acquisition. Account retained, post-acquisition data deleted, subscription canceled and refunded.

Type C: account created during Meta's ownership, or a pre-existing account whose email or user information changed during that period. These users lost the account record itself, and every task, subscription, and piece of associated data went with it. They had to restore the account before they could restore anything else.

Read Type C closely. The temporal boundary decided whether a user's identity record counted as separable from Meta or as part of Meta. If you created your account while Meta owned Manus, the account was architecturally Meta's. It had to be destroyed and rebuilt from backup.

What connector separation actually required

What a user experiences as one connector is three distinct objects: the configuration, the OAuth grant or credential that authorizes it, and the task or project state that references it. Backup could preserve the configuration. The OAuth grant could not move. It is an authorization a user gave to a specific entity to access a specific service, and the entity holding it had changed. Users had to reauthenticate every connector after restoration.

Facebook login got blunter treatment. Users who signed in only through Facebook were told to add another login method before the transition. That integration was removed and not restored.

For hosted web projects, the documentation listed what users needed to verify after restoration: deployed versions, custom domains and DNS, Cloud Computer files and addresses, running processes, web services, certificates, firewall settings, and stored credentials. Requests that arrived while a site was down were not replayed. Human and AI support were unavailable globally during the deletion window, including for users whose accounts were otherwise untouched.

Teams added another layer. Only team owners could create an importable backup. Ordinary members could export readable copies of their own task material, but those exports could not reconstruct the workspace. If the owner was Type C, the whole team account was deleted, and the owner had to restore it before anyone else got anything back.

Backup archives ran from tens of megabytes to tens of gigabytes, split into four-gigabyte packages. Manus handed the state migration to its users to execute.

Agent platforms break the standard acquisition assumption

The working assumption in SaaS M&A is that ownership changes at the corporate level while the product keeps running underneath. For agent platforms that assumption holds poorly. An agent that holds delegated credentials to your email, your code repositories, and your project management tools, and that also maintains persistent compute, hosted deployments, and multi-session task history, ties the corporate layer to the product layer in a way a traditional SaaS subscription does not.

The authorization graph, the execution state, and the identity layer each carry the legal fingerprint of whoever owns the platform at the moment they're established. When you acquire an agent platform, you inherit the OAuth grants, persistent sessions, and credential stores that users established under the prior owner. A reversal has to undo each of those bindings individually.

NIST's 2026 concept paper on agent identity and authorization treats this as a distinct production concern: agents need delegated, managed access to multiple systems, and identity provisioning, revocation, and policy enforcement remain separate controls. Manus is the first large-scale case of those controls being exercised involuntarily, across an entire user base, because corporate ownership changed.

What Meta kept, and what the gap means

The public record doesn't settle this. The NDRC order required the parties to revoke the acquisition transaction and specified no IP, licensing, or data-destruction terms. By June, Bloomberg reported that Meta and Manus had completed an operational split, halted data sharing, and put a firewall between the companies. A staff bulletin from the U.S.-China Economic and Security Review Commission (USCC) interpreted full compliance as requiring Meta to destroy acquired data, technology, and documentation. That was staff analysis, not the order.

Neither Manus's independence announcement nor Meta's 10-Q for the quarter says whether Meta retained a license to any Manus technology. I'd put high confidence on full separation of ownership, operational access, and data sharing. Nothing confirms that every technology transfer was reversed.

The gap matters for two evaluations. First, Meta launched Muse on September 8, a general-purpose personal agent that runs in a dedicated VM and handles email, travel, shopping, and longer-term projects. That is the category Meta bought Manus to enter. Whether Muse benefited from Manus technology during the four months Meta held the company can't be answered from public sources, and the answer changes how you should read Muse's competitive position. Second, the IP question tests whether a forced unwind achieves full technological separation or only operational separation. If it's operational only, the regulatory tool is weaker than it looks, because the acquirer loses control but may keep what it learned. Every future cross-border agent deal will be priced against that ambiguity.

How the precedent changes agent deal structure

The general-purpose agent category filled out fast. OpenAI launched Dots on September 29: always-on agents with their own cloud computers and 4,000+ application connections. Anthropic merged Cowork into Claude on September 16, enabling persistent work across connected applications. Perplexity's Computer runs multi-step workflows across 400+ applications. Genspark produces completed deliverables from objectives using connected business data. That is five major entrants in six months, all building the same integration surface that made the Manus unwind expensive.

More platforms with that surface means more acquisition decisions that have to account for it, and the Manus precedent is already visible in how deals are being structured.

The licensing alternative is emerging. The Information reported that Nvidia, in discussions about investing in Perplexity at above $30 billion, had earlier considered a separate arrangement to license Perplexity's technology and hire some employees. Technology access without corporate ownership sidesteps the problem Manus exposed: there is no ownership for a regulator to reverse, and no user's OAuth grants carry the buyer's corporate fingerprint. Whether Manus directly shaped Nvidia's thinking is unknowable. That the structure surfaced in the same year is observable. Treat the causal link as speculative and the timing as fact.

Meta built instead of re-acquiring. Muse launched roughly eight months after the close and less than five months after the NDRC order. Meta did not go after another agent platform. Plenty of factors feed a build-over-buy call, but one of them is now demonstrable: buying an agent platform means accepting that a forced reversal reaches the user layer — identity, authorization, execution state. Meta has already absorbed that cost.

Genspark is the closest structural match. Chinese-linked investors (Tencent and HongShan), founders with prior Baidu experience, an international operating structure, and a product that runs on delegated access to user applications and data. No source I reviewed reports pending regulatory action. Call the exposure moderate confidence, built on pattern rather than any filing. After Manus, though, the pattern is no longer hypothetical. Any acquirer evaluating Genspark now has to model the unwind cost, and Manus's help center documents show in granular detail that the cost scales with integration depth.

Manus post-independence

Manus resumed independent operations September 1. The Information reported October 7 that the company raised more than $500 million, and that revenue had grown from roughly $100 million annualized at the time of acquisition to between $400 million and $500 million by June. These are private-market figures, unaudited, and the October run rate is unknown.

Go back to the Type C users who completed restoration. Their accounts had been destroyed. Returning meant restoring the identity record, reauthorizing every connector, and verifying every deployment. The same process produced involuntary churn and voluntary re-engagement. As a loyalty signal, that beats a renewal metric, because renewal happens by default and restoration takes work.

The verdict

The USCC characterized Manus as the first public use of China's foreign-investment review to block investment in the country's AI sector. Cross-border intervention in AI-adjacent deals has precedent. CFIUS forced iCarbonX to divest PatientsLikeMe in 2019. Microsoft restructured G42's supplier relationships under U.S. pressure. Nvidia's Arm acquisition collapsed under resistance from multiple jurisdictions. None of those required users to back up their data, delete their accounts, and rebuild their authorization state. That user-level disruption is what distinguishes the Manus case.

Acquirers who have been modeling M&A risk as a corporate-finance problem now need to model it as an architecture problem, counting the OAuth grants, persistent sessions, credential stores, and hosted environments a target manages for its users.

The companies to watch, in priority order:

• Genspark, for regulatory exposure. Its ownership and operating pattern is the closest match to pre-acquisition Manus.
• Perplexity, for deal structure. The reported Nvidia licensing arrangement may be the first visible adaptation to the new risk calculus.
• Meta Muse, for the unresolved technology question: whether a forced unwind achieves full separation or leaves the acquirer with residual knowledge that shapes what it builds next.

Manus comes out of the unwind better capitalized and with higher revenue than when it was acquired, and the users who came back after restoration chose to. What Manus hasn't published is whether that base held or eroded. That retention figure, when it surfaces, will say more about the real cost of the unwind than anything in the NDRC order.