---
title: Profero: Grok Bot's hosted sandbox exposes an unauthenticated Docker API and a hard-coded exec token that turn one agent command into remote root on the account VM | ctxsec
url: https://ctxsec.com/items/profero-grok-bot-sandbox-docker-api-escape-nov-8
description: "Israeli firm Profero published a Nov 8 write-up arguing that Grok Bot's cloud sandbox \u2014 a Linux container inside a per-account VM operated by Cursor \u2014 can be fully compromised if an attacker gets a single hostile command into any agent on the account. Profero says the chain needs no novel exploit and no CVE: an unauthenticated Docker control API reachable from the sandbox yields a privileged container and root on that VM; per-account gateway and long-lived renewal credentials sit in the container config on disk; and the exec daemon that runs agent commands ships with a hard-coded authentication token that is the word local in every image they tested. With those pieces, Profero says an attacker can run commands in the sandbox and as root on the VM from any laptop, read imported browser cookies and connected-service tokens, access the account's persistent file store, and keep catching rotated tokens from plaintext management traffic. The firm frames this as a \"rootkit\" built from the product's own control plane rather than planted malware. The report's featured image is promotional art, not a live exploit screenshot. Profero says it emailed xAI and Cursor on Aug 24 with eight scored vulnerabilities, reproduction steps and suggested fixes; Cursor's only reply was an automated bug-bounty portal message on Aug 25, and neither vendor acknowledged the report before Profero published more than 75 days later. Mia (@MiaAI_lab) amplified the post on Nov 9. This item restates Profero's claims and disclosure timeline; it does not independently re-test the platform."
status: "research (Profero, Nov 8); Profero says it reported eight issues to xAI and Cursor on Aug 24, got only an automated Cursor bug-bounty reply, and that the findings still held across more than 240 sandbox builds through publication; no public vendor acknowledgment or fix statement found as of this write-up; no CVE"
published: 2026-11-09
---

> Israeli firm Profero published a Nov 8 write-up arguing that Grok Bot's cloud sandbox — a Linux container inside a per-account VM operated by Cursor — can be fully compromised if an attacker gets a single hostile command into any agent on the account. Profero says the chain needs no novel exploit and no CVE: an unauthenticated Docker control API reachable from the sandbox yields a privileged container and root on that VM; per-account gateway and long-lived renewal credentials sit in the container config on disk; and the exec daemon that runs agent commands ships with a hard-coded authentication token that is the word local in every image they tested. With those pieces, Profero says an attacker can run commands in the sandbox and as root on the VM from any laptop, read imported browser cookies and connected-service tokens, access the account's persistent file store, and keep catching rotated tokens from plaintext management traffic. The firm frames this as a "rootkit" built from the product's own control plane rather than planted malware. The report's featured image is promotional art, not a live exploit screenshot. Profero says it emailed xAI and Cursor on Aug 24 with eight scored vulnerabilities, reproduction steps and suggested fixes; Cursor's only reply was an automated bug-bounty portal message on Aug 25, and neither vendor acknowledged the report before Profero published more than 75 days later. Mia (@MiaAI_lab) amplified the post on Nov 9. This item restates Profero's claims and disclosure timeline; it does not independently re-test the platform.

[← Context & Harness Attacks](/context) · [markdown](/items/profero-grok-bot-sandbox-docker-api-escape-nov-8.md)

research (Profero, Nov 8); Profero says it reported eight issues to xAI and Cursor on Aug 24, got only an automated Cursor bug-bounty reply, and that the findings still held across more than 240 sandbox builds through publication; no public vendor acknowledgment or fix statement found as of this write-up; no CVE

2026-11-09

### Profero: Grok Bot's hosted sandbox exposes an unauthenticated Docker API and a hard-coded exec token that turn one agent command into remote root on the account VM

- **What Profero describes (high level):** layer 1 is the agent sandbox container; layer 2 is the account's dedicated VM running Docker and a supervisor; layer 3 is the shared EC2 host. Profero says it could not cross into other customers' VMs. The reported path stays inside one account: sandbox → unauthenticated Docker API on the VM → privileged container with the VM disk attached → credentials copied from container config → remote use of the exec service (static auth token `local`) and the control plane's long-lived renewal credential.
- **Blast radius (per Profero):** every agent on the account shares one Linux user, one filesystem and one credential set, so one bad instruction in any agent exposes imported browser sessions (saved in plaintext JSON; Chrome remote debugging also open with no auth), the gateway token that drives connected mail/files/calendar connectors, and every object in the account's persistent S3-backed store — including the ability to plant files that sync into future sandboxes. Persistence is claimed to survive vendor token rotation because a listener on the VM's plaintext proxy-to-sandbox link can collect each new per-account token.
- **Entry point:** Profero treats "one command from the agent" as the premise that fails — via prompt injection on a web page the agent reads, a malicious repository, a poisoned package, or a hostile tool. No malware dropper is required once that command runs.
- **"Rootkit" framing:** Profero is not claiming a kernel rootkit was shipped on purpose. It argues the exposed, unauthenticated control plane plus static secrets and plaintext management traffic behave like one: remote shell, secret theft and persistence with no login record. Eight issues were scored (several Critical on CVSS 3.1 in their table); none have public CVEs in the report.
- **Disclosure (Profero's timeline):** testing Aug 22–23 on accounts they paid for; full report to xAI and Cursor security teams Aug 24; Cursor automated bug-bounty reply Aug 25; follow-ups to xAI Aug 27–28, Sep 8, Sep 18 (30-day notice), Oct 1 and Nov 8; re-tests through Sep–Oct on new builds with findings unchanged; publication in November, more than 75 days after first report. Profero says more than 240 sandbox builds shipped in that window without closing the chain.
- **Vendor status as of this write-up:** we found no public statement from xAI, Cursor or Grok Bot acknowledging the report or claiming a fix. Patch status beyond Profero's own re-tests is unverified here; do not read this item as an independent confirmation that the issues remain live today.
- **Why it matters beyond one product:** the failure modes Profero lists — secrets baked into images, local management APIs reachable without auth, boot scripts that grant root, management traffic forwarded in plaintext, and one shared identity for every agent — are design risks for any hosted agent sandbox, not only this one.

Sources: [Profero: The Rootkit Built Into Grok Bot (Omri Segev Moyal, Nov 8, 2026)](https://profero.io/blog/the-rootkit-built-into-grok-bot) · [TLDR summary of the Profero Grok Bot report](https://tldr.tech/story/fa901c1b-f5de-40e9-a85f-ba7cafa4605d) · [Mia (@MiaAI_lab) on X amplifying the Profero report (Nov 9, 2026)](https://x.com/MiaAI_lab/status/2119840056965730389)