Unpatched flaws in xAI's Grok Bot agent sandbox let one prompt-injected command take root, run commands remotely, and read every file and login saved on the account (Profero, no fix, no CVE)

Profero published research on 8 Nov 2026 about Grok Bot, the xAI product that gives AI agents a cloud Linux computer with a shell, a browser and saved logins. Cursor runs the sandbox infrastructure. The sandbox can reach the VM's Docker API without logging in, which gives root on the VM. A config file on the VM holds the account's routing token and a long-lived credential. The exec service uses one hard-coded password that is the same in every sandbox, so anyone holding the routing token can run commands from outside. The long-lived credential can read, download and upload every file saved on the account, and new tokens reach the sandbox in plain text, so an attacker can keep access after tokens rotate. Profero also found a supervisor service that runs commands as root with no login, a passwordless sudo rule added at every boot, imported browser cookies stored in plain text, and Chrome remote debugging open with no login. All agents on an account run as the same Linux user. Profero rates seven issues at CVSS 7.1 to 9.6. The flaws were present in every build tested from August to November 2026 (more than 240 builds). Profero reported them to xAI and Cursor on 24 Aug 2026 and got no answer apart from Cursor's automated bug-bounty reply. No fix exists and no CVE has been assigned. Profero has seen no attacks in the wild. The attack needs a starting point such as a prompt injection or a malicious package. Profero left out hostnames, tokens and proof-of-concept code.