The report
A command running inside an AI agent’s sandbox is supposed to remain a command within that sandbox. Profero’s November 8 research describes a configuration in which one such command could instead reach the virtual machine hosting the account’s agents, then recover browser sessions and connected-service credentials.
Three layers, one proved boundary crossing
Profero distinguishes the container where the agent executes, a dedicated virtual machine for that customer account, and the underlying shared EC2 host. In its test accounts, exposed container-management and supervisor controls plus a fixed remote-execution secret created a route from the first layer to root on the second. The research does not report crossing from the account VM into the third, shared host. Calling the issue a cross-customer hypervisor escape would misstate the evidence.
The prerequisites also matter. A hostile actor must first cause at least one executable command to run inside the agent’s sandbox, for example through an agent-consumed malicious page, file or package. This is not a claim that any anonymous internet visitor could directly log into every Grok Bot account. Once the first command ran in Profero’s tests, the researchers could read stored browser material and connected-service tokens, and use long-lived storage authority. A token rotation was not sufficient to remove an attacker who retained account-VM access and could observe fresh tokens.
Profero says it notified xAI and Cursor on August 24 and observed the issues across subsequent builds. The research Case records the tested constraints; the primary report does not establish a confirmed outside victim, vendor acknowledgement or fixed release.
The design concern reaches beyond this product: sandbox containment, customer VM management and credential availability are different controls. Even if model prompts are reviewed correctly, arbitrary code already permitted inside the agent must not reach account-wide supervisor interfaces, cached browser sessions or reusable connector authority. The most informative follow-up would be a vendor-side account-isolation retest, not speculation about other tenants.