{"id":"TECH-202611-zvm4fa","kind":"technique","aliases":[],"related":[],"title":"Unpatched flaws in xAI's Grok Bot agent sandbox let one prompt-injected command take root, run commands remotely, and read every file and login saved on the account (Profero, no fix, no CVE)","description":null,"summary":"Profero published research on 8 Nov 2026 about Grok Bot, the xAI product that gives AI agents a cloud Linux computer with a shell, a browser and saved logins. Cursor runs the sandbox infrastructure. The sandbox can reach the VM's Docker API without logging in, which gives root on the VM. A config file on the VM holds the account's routing token and a long-lived credential. The exec service uses one hard-coded password that is the same in every sandbox, so anyone holding the routing token can run commands from outside. The long-lived credential can read, download and upload every file saved on the account, and new tokens reach the sandbox in plain text, so an attacker can keep access after tokens rotate. Profero also found a supervisor service that runs commands as root with no login, a passwordless sudo rule added at every boot, imported browser cookies stored in plain text, and Chrome remote debugging open with no login. All agents on an account run as the same Linux user. Profero rates seven issues at CVSS 7.1 to 9.6. The flaws were present in every build tested from August to November 2026 (more than 240 builds). Profero reported them to xAI and Cursor on 24 Aug 2026 and got no answer apart from Cursor's automated bug-bounty reply. No fix exists and no CVE has been assigned. Profero has seen no attacks in the wild. The attack needs a starting point such as a prompt injection or a malicious package. Profero left out hostnames, tokens and proof-of-concept code.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Grok Bot","fixed":[],"vendor":"xAI"},{"name":"Cursor (Grok Bot sandbox infrastructure)","fixed":[],"vendor":"Cursor"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"Check whether your team uses xAI Grok Bot agent sandboxes. Indicators from Profero, best watched from outside the sandbox because an attacker can change its own logs: traffic to the Docker API port 2375 or the exec service ports 1337, 1338 and 1340; requests to the supervisor's process-creation endpoint; requests to the exec endpoint using the shared static token; container config files containing SAND_GATEWAY_TOKEN or SAND_INFERENCE_RENEWAL_CREDENTIAL; a sandbox policy shown as 'insecure, none'; supervisor startup logs with an empty auth token; unexpected sudo rules for the agent user or unexpected marker files in /tmp; and outbound connections, control-plane token use or DNS lookups of sandbox hostnames from unexpected places. Profero did not publish specific hostnames or tokens.","fix":"No vendor fix exists. Treat Grok Bot sandboxes as hostile. Keep production browser sessions, personal cookies and long-lived API keys out of them. Give the agent its own identity with narrow connectors. Rotate any credentials, cookies or keys that were imported into or used inside a Grok Bot sandbox. Monitor from outside the sandbox. Ask xAI about patch status before using it for sensitive work.","status":"open","published_at":null,"first_seen_at":"2026-11-09T13:48:36+00:00","triaged_at":"2026-11-09T13:48:36+00:00","updated_at":"2026-11-09T13:49:05+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':37A '2026':56B,250B,265B '24':263B '240':253B '7.1':235B '8':54B '9.6':237B 'access':177B 'account':30A,110B,162B,222B 'add':199B 'agent':8A,66B,219B 'ai':65B 'also':182B 'answer':269B 'anyon':137B 'apart':270B 'api':92B 'assign':287B 'attack':174B,292B,297B 'aug':264B 'august':247B 'autom':274B 'boot':202B 'bot':7A,40A,43A,59B 'bounti':277B 'browser':75B,204B 'bug':276B 'bug-bounti':275B 'build':244B,254B 'chrome':211B 'cloud':68B 'code':127B,321B 'command':15A,19A,144B,189B 'comput':70B 'concept':320B 'config':103B 'cooki':205B 'credenti':119B,151B 'cursor':41A,79B,261B,272B 'cve':35A,284B 'cvss':234B 'debug':213B 'docker':91B 'download':154B 'earli':47B 'early-warn':46B 'everi':23A,134B,157B,201B,243B 'exec':121B 'exist':281B 'file':24A,104B,158B 'fix':33A,280B 'flaw':2A,239B 'found':183B 'give':64B,97B 'got':267B 'grok':6A,39A,42A,58B 'hard':126B 'hard-cod':125B 'hold':108B,138B 'hostnam':314B 'import':203B 'infrastructur':83B 'infrastructure':45A 'inject':14A,306B 'issu':232B 'keep':176B 'left':312B 'let':10A 'linux':69B,227B 'live':118B,150B 'log':94B 'login':26A,78B,194B,217B 'long':117B,149B 'long-liv':116B,148B 'malici':309B 'need':298B 'new':164B 'nov':55B 'novemb':249B 'one':11A,124B 'open':214B 'outsid':146B 'packag':310B 'password':128B 'passwordless':196B 'plain':170B,208B 'point':301B 'present':241B 'product':62B 'profero':31A,50B,181B,229B,255B,288B,311B 'prompt':13A,305B 'prompt-inject':12A 'proof':318B 'proof-of-concept':317B 'publish':51B 'rate':230B 'reach':87B,166B 'read':22A,153B 'remot':20A,212B 'repli':278B 'report':256B 'research':52B 'root':17A,98B,191B 'rotat':180B 'rout':112B,140B 'rule':198B 'run':18A,80B,143B,188B,223B 'sandbox':9A,44A,82B,85B,135B,168B 'save':27A,77B,159B 'seen':290B 'servic':122B,186B 'seven':231B 'shell':73B 'start':300B 'store':206B 'sudo':197B 'supervisor':185B 'take':16A 'tech':36A 'techniqu':49B 'test':245B 'text':171B,209B 'token':113B,141B,165B,179B,315B 'unpatch':1A 'upload':156B 'use':123B 'user':228B 'vm':89B,101B,107B 'warn':48B 'wild':295B 'without':93B 'xai':4A,61B,259B 'zvm4fa':38A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["bot","cursorgrokbotsandboxinfrastructure","grokbot","grokbotsandboxinfrastructure"],"ptokens":["bot","cursor","grok","infrastructure","sandbox"],"labels":["aitooling","earlywarning","high","technique"],"campaign_type":"exploitation","search_a":"'-202611':37A 'account':30A 'agent':8A 'bot':7A,40A,43A 'command':15A,19A 'cursor':41A 'cve':35A 'everi':23A 'file':24A 'fix':33A 'flaw':2A 'grok':6A,39A,42A 'infrastructure':45A 'inject':14A 'let':10A 'login':26A 'one':11A 'profero':31A 'prompt':13A 'prompt-inject':12A 'read':22A 'remot':20A 'root':17A 'run':18A 'sandbox':9A,44A 'save':27A 'take':16A 'tech':36A 'unpatch':1A 'xai':4A 'zvm4fa':38A","search_b":"'2026':56B,250B,265B '24':263B '240':253B '7.1':235B '8':54B '9.6':237B 'access':177B 'account':110B,162B,222B 'add':199B 'agent':66B,219B 'ai':65B 'also':182B 'answer':269B 'anyon':137B 'apart':270B 'api':92B 'assign':287B 'attack':174B,292B,297B 'aug':264B 'august':247B 'autom':274B 'boot':202B 'bot':59B 'bounti':277B 'browser':75B,204B 'bug':276B 'bug-bounti':275B 'build':244B,254B 'chrome':211B 'cloud':68B 'code':127B,321B 'command':144B,189B 'comput':70B 'concept':320B 'config':103B 'cooki':205B 'credenti':119B,151B 'cursor':79B,261B,272B 'cve':284B 'cvss':234B 'debug':213B 'docker':91B 'download':154B 'earli':47B 'early-warn':46B 'everi':134B,157B,201B,243B 'exec':121B 'exist':281B 'file':104B,158B 'fix':280B 'flaw':239B 'found':183B 'give':64B,97B 'got':267B 'grok':58B 'hard':126B 'hard-cod':125B 'hold':108B,138B 'hostnam':314B 'import':203B 'infrastructur':83B 'inject':306B 'issu':232B 'keep':176B 'left':312B 'linux':69B,227B 'live':118B,150B 'log':94B 'login':78B,194B,217B 'long':117B,149B 'long-liv':116B,148B 'malici':309B 'need':298B 'new':164B 'nov':55B 'novemb':249B 'one':124B 'open':214B 'outsid':146B 'packag':310B 'password':128B 'passwordless':196B 'plain':170B,208B 'point':301B 'present':241B 'product':62B 'profero':50B,181B,229B,255B,288B,311B 'prompt':305B 'proof':318B 'proof-of-concept':317B 'publish':51B 'rate':230B 'reach':87B,166B 'read':153B 'remot':212B 'repli':278B 'report':256B 'research':52B 'root':98B,191B 'rotat':180B 'rout':112B,140B 'rule':198B 'run':80B,143B,188B,223B 'sandbox':82B,85B,135B,168B 'save':77B,159B 'seen':290B 'servic':122B,186B 'seven':231B 'shell':73B 'start':300B 'store':206B 'sudo':197B 'supervisor':185B 'techniqu':49B 'test':245B 'text':171B,209B 'token':113B,141B,165B,179B,315B 'upload':156B 'use':123B 'user':228B 'vm':89B,101B,107B 'warn':48B 'wild':295B 'without':93B 'xai':61B,259B","search_c":"","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-zvm4fa","url":"https://profero.io/blog/the-rootkit-built-into-grok-bot","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-09T13:48:36+00:00","fetched_at":"2026-11-09T13:48:36+00:00","note":null,"cites":["https://profero.io/blog/the-rootkit-built-into-grok-bot"]}],"documents":[{"id":107653,"url":"https://news.ycombinator.com/item?id=50425428","title":"xAI ignoring Grokbot rootkit vulnerability","kind":"post","source":"hackernews","publisher":null,"text":"xAI ignoring Grokbot rootkit vulnerability\nhttps://profero.io/blog/the-rootkit-built-into-grok-bot\n\n3 points, 0 comments on Hacker News","published_at":"2026-11-09T13:37:52+00:00","relation":"describes","confidence":null,"note":null},{"id":107655,"url":"https://profero.io/blog/the-rootkit-built-into-grok-bot","title":"The rootkit built into Grok Bot (Profero)","kind":"blog","source":"analyst","publisher":null,"text":"Profero research: Grok Bot (xAI) gives AI agents a cloud Linux computer; sandbox infrastructure operated by Cursor. Chain of unauthenticated HTTP steps: Docker API (port 2375) on customer VM reachable from sandbox without auth -> privileged container with VM disk mounted (VM root); container config on VM disk holds per-account routing token SAND_GATEWAY_TOKEN and long-lived credential SAND_INFERENCE_RENEWAL_CREDENTIAL; sandbox exec service (ports 1337, 1338, 1340) uses hard-coded password identical across sandboxes -> remote command execution with routing token; long-lived credential mints storage tokens to read/download/upload all account files; proxy forwards tokens in plaintext so attacker with VM root captures rotated tokens. Also: unauthenticated supervisor service running commands as root (empty auth token at startup), passwordless sudo rule at every boot, plaintext imported browser cookies, unauthenticated Chrome remote debugging, signing key in image allowing forged browser extension; all agents on an account share one Linux user. Seven issues, CVSS 7.1-9.6. Held on every build tested Aug-Nov 2026 (240+ builds). No exploitation observed; needs initial foothold such as prompt injection or malicious package. Reported to xAI and Cursor 24 Aug 2026; no response except Cursor automated bug bounty reply; published 8 Nov 2026 unpatched. Guidance: treat sandbox as hostile, keep production browser sessions, personal cookies and long-lived API keys out, dedicated narrow agent identity, monitor from outside the sandbox, plan credential rotation.","published_at":"2026-11-08T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}