Profero publishes Grok Bot research

On paid test accounts, Profero inspected a Grok Bot arrangement of a containerized agent sandbox, its dedicated account virtual machine and the underlying shared EC2 host. From a command already running inside the sandbox, a reachable unauthenticated Docker API permitted launching a privileged container against the account VM; an unprotected supervisor and a fixed remote-exec token expanded the effect into persistent access.

The investigators report plaintext imported Chrome cookies, connected-service gateway tokens and long-lived storage authority accessible after this chain. Repeated sandbox-build checks reportedly left the findings reproducible, and the researchers sent eight findings to xAI and Cursor beginning August 24. These are tests on researcher-controlled accounts, not observed attacker exfiltration from other customers. Profero explicitly reports it could not cross the account-VM-to-shared-EC2 boundary.

Affected Grok Bot sandbox deployments as tested by Profero in August through October, disclosed November 8. The initial requirement is that attacker-controlled material cause at least one executable command in a sandbox; an anonymous internet user cannot be assumed to have that entry point.

No public vendor acknowledgment, precise fixed release, production-victim count or access to another customer VM is established. The article calls the chain rootkit-like; it does not identify a kernel rootkit installed by the vendor.

Profero's entry condition is deliberately narrow: one executable command must first reach a Grok Bot sandbox, for example through a malicious file, page or other agent-consumed instruction. From there, the researchers report two account-local management weaknesses, including a fixed remote-execution secret and unauthenticated container-control interfaces. Those can shift control from the restricted agent process to the virtual machine hosting that user's bots and the credentials imported into its browser and connector environment.

The researchers notified xAI and Cursor on August 24 and report reproducibility across later builds, but a public vendor acknowledgment and independent victim incident remain unavailable. They did not escape into the underlying multitenant EC2 host. The practical containment line is therefore between an agent sandbox and its own account VM, not between two separate customers. Short-lived tokens alone do not cure the path if an attacker with account-VM control can repeatedly read freshly issued tokens.