--- id: "TECH-202611-zvm4fa" page: "https://infrastack.ai/live/TECH-202611-zvm4fa" kind: "technique" aliases: [] title: "Unpatched flaws in xAI's Grok Bot agent sandbox let one prompt-injected command take root, run commands remotely, and read every file and login saved on the account (Profero, no fix, no CVE)" severity: "high" cvss: null epss: null exploited: false status: "open" category: "ai-tooling" products: [{"name": "Grok Bot", "fixed": [], "vendor": "xAI"}, {"name": "Cursor (Grok Bot sandbox infrastructure)", "fixed": [], "vendor": "Cursor"}] ecosystems: [] tags: ["early-warning", "technique"] not_affected_if: [] published_at: null first_seen_at: "2026-11-09T13:48:36+00:00" updated_at: "2026-11-09T13:49:05+00:00" sources: [{"source": "analyst", "url": "https://profero.io/blog/the-rootkit-built-into-grok-bot", "first_seen_at": "2026-11-09T13:48:36+00:00", "cites": ["https://profero.io/blog/the-rootkit-built-into-grok-bot"]}] exploit_sources: [] --- # Unpatched flaws in xAI's Grok Bot agent sandbox let one prompt-injected command take root, run commands remotely, and read every file and login saved on the account (Profero, no fix, no CVE) Link for people: https://infrastack.ai/live/TECH-202611-zvm4fa (this .md is for agents) Profero published research on 8 Nov 2026 about Grok Bot, the xAI product that gives AI agents a cloud Linux computer with a shell, a browser and saved logins. Cursor runs the sandbox infrastructure. The sandbox can reach the VM's Docker API without logging in, which gives root on the VM. A config file on the VM holds the account's routing token and a long-lived credential. The exec service uses one hard-coded password that is the same in every sandbox, so anyone holding the routing token can run commands from outside. The long-lived credential can read, download and upload every file saved on the account, and new tokens reach the sandbox in plain text, so an attacker can keep access after tokens rotate. Profero also found a supervisor service that runs commands as root with no login, a passwordless sudo rule added at every boot, imported browser cookies stored in plain text, and Chrome remote debugging open with no login. All agents on an account run as the same Linux user. Profero rates seven issues at CVSS 7.1 to 9.6. The flaws were present in every build tested from August to November 2026 (more than 240 builds). Profero reported them to xAI and Cursor on 24 Aug 2026 and got no answer apart from Cursor's automated bug-bounty reply. No fix exists and no CVE has been assigned. Profero has seen no attacks in the wild. The attack needs a starting point such as a prompt injection or a malicious package. Profero left out hostnames, tokens and proof-of-concept code. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :Grok Bot affected range not listed fixed no fixed version listed - :Cursor (Grok Bot sandbox infrastructure) affected range not listed fixed no fixed version listed ## How to check Check whether your team uses xAI Grok Bot agent sandboxes. Indicators from Profero, best watched from outside the sandbox because an attacker can change its own logs: traffic to the Docker API port 2375 or the exec service ports 1337, 1338 and 1340; requests to the supervisor's process-creation endpoint; requests to the exec endpoint using the shared static token; container config files containing SAND_GATEWAY_TOKEN or SAND_INFERENCE_RENEWAL_CREDENTIAL; a sandbox policy shown as 'insecure, none'; supervisor startup logs with an empty auth token; unexpected sudo rules for the agent user or unexpected marker files in /tmp; and outbound connections, control-plane token use or DNS lookups of sandbox hostnames from unexpected places. Profero did not publish specific hostnames or tokens. ## Fix No vendor fix exists. Treat Grok Bot sandboxes as hostile. Keep production browser sessions, personal cookies and long-lived API keys out of them. Give the agent its own identity with narrow connectors. Rotate any credentials, cookies or keys that were imported into or used inside a Grok Bot sandbox. Monitor from outside the sandbox. Ask xAI about patch status before using it for sensitive work. ## Timeline - 2026-11-09T13:48:36+00:00 analyst https://profero.io/blog/the-rootkit-built-into-grok-bot ## Documents - [describes] xAI ignoring Grokbot rootkit vulnerability https://news.ycombinator.com/item?id=50425428 - [describes] The rootkit built into Grok Bot (Profero) https://profero.io/blog/the-rootkit-built-into-grok-bot --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_