Evidence · DiggingBeagle record
Profero: The Rootkit Built Into Grok Bot, account VM sandbox research
- Published
- Nov 8, 2026
- Source role
- primary disclosure
Evidence record
Claim-level citations (3)
- supportsProfero publishes Grok Bot research: Profero disclosed an August 24 notification, reported continued reproducibility on subsequent sandbox builds, and expressly distinguished account-VM root from an escape into the shared underlying EC2 host.
Opening report paragraphs and Three layers: sandbox, account VM and shared host
- supportsProfero publishes Grok Bot research: Profero demonstrated sandbox-to-account-VM root control using exposed Docker/supervisor control surfaces and a fixed remote-execution token in tested Grok Bot builds.
The three layers; Vulnerabilities table; Steps 1-4
- supportsProfero publishes Grok Bot research: Profero documented readable imported browser-session and connected-service credentials, while reporting no escape from its account VM into the shared EC2 host.
The three layers; Five more findings; disclosure notes