Profero: Grok Bot's hosted sandbox exposes an unauthenticated Docker API and a hard-coded exec token that turn one agent command into remote root on the account VM
- What Profero describes (high level): layer 1 is the agent sandbox container; layer 2 is the account's dedicated VM running Docker and a supervisor; layer 3 is the shared EC2 host. Profero says it could not cross into other customers' VMs. The reported path stays inside one account: sandbox → unauthenticated Docker API on the VM → privileged container with the VM disk attached → credentials copied from container config → remote use of the exec service (static auth token
local) and the control plane's long-lived renewal credential. - Blast radius (per Profero): every agent on the account shares one Linux user, one filesystem and one credential set, so one bad instruction in any agent exposes imported browser sessions (saved in plaintext JSON; Chrome remote debugging also open with no auth), the gateway token that drives connected mail/files/calendar connectors, and every object in the account's persistent S3-backed store — including the ability to plant files that sync into future sandboxes. Persistence is claimed to survive vendor token rotation because a listener on the VM's plaintext proxy-to-sandbox link can collect each new per-account token.
- Entry point: Profero treats "one command from the agent" as the premise that fails — via prompt injection on a web page the agent reads, a malicious repository, a poisoned package, or a hostile tool. No malware dropper is required once that command runs.
- "Rootkit" framing: Profero is not claiming a kernel rootkit was shipped on purpose. It argues the exposed, unauthenticated control plane plus static secrets and plaintext management traffic behave like one: remote shell, secret theft and persistence with no login record. Eight issues were scored (several Critical on CVSS 3.1 in their table); none have public CVEs in the report.
- Disclosure (Profero's timeline): testing Aug 22–23 on accounts they paid for; full report to xAI and Cursor security teams Aug 24; Cursor automated bug-bounty reply Aug 25; follow-ups to xAI Aug 27–28, Sep 8, Sep 18 (30-day notice), Oct 1 and Nov 8; re-tests through Sep–Oct on new builds with findings unchanged; publication in November, more than 75 days after first report. Profero says more than 240 sandbox builds shipped in that window without closing the chain.
- Vendor status as of this write-up: we found no public statement from xAI, Cursor or Grok Bot acknowledging the report or claiming a fix. Patch status beyond Profero's own re-tests is unverified here; do not read this item as an independent confirmation that the issues remain live today.
- Why it matters beyond one product: the failure modes Profero lists — secrets baked into images, local management APIs reachable without auth, boot scripts that grant root, management traffic forwarded in plaintext, and one shared identity for every agent — are design risks for any hosted agent sandbox, not only this one.
Sources: Profero: The Rootkit Built Into Grok Bot (Omri Segev Moyal, Nov 8, 2026) · TLDR summary of the Profero Grok Bot report · Mia (@MiaAI_lab) on X amplifying the Profero report (Nov 9, 2026)