What happened
In a November 8, 2026 disclosure, security firm Profero describes its assessment of Grok Bot, an agent product that gives an AI agent a cloud Linux environment with a shell, browser and desktop. Profero says a customer preparing to deploy the product asked it to assess the risks. The firm tested on accounts it paid for itself on August 22 and 23, then sent a report to xAI and Cursor on August 24. Cursor operates the sandbox infrastructure, according to Profero. The post says the firms had not acknowledged the report by publication and that the findings remained reproducible after more than 240 sandbox builds.
The central claim is a chain across two boundaries. Inside the sandbox, Profero found that an unauthenticated Docker control API was reachable from the agent’s environment. It says this let an agent command ask Docker to create a privileged container with the virtual machine’s disk mounted, reaching root on that VM. Profero distinguishes this VM from the underlying AWS EC2 host: it says its testing did not cross into that host or another customer’s environment. The disclosure also describes a supervisor service without an authentication token and a boot-time rule granting the agent user passwordless root inside the sandbox.
Profero says it extracted two credentials from a Docker configuration file on the VM: an account-specific routing token and a long-lived credential used to obtain fresh access tokens. The firm reports that the routing token, combined with a static password set to “local” in the sandbox image, allowed it to send commands to its own sandbox from an external laptop. It says the long-lived credential could be exchanged for access to the account’s persistent storage, including listing, downloading and uploading files. The firm further reports that management traffic forwarded between the VM and sandbox exposed live tokens in plaintext, allowing a listener on the VM to capture rotated routing tokens.
The disclosure describes additional exposure within the environment: imported browser cookies saved in a plaintext file, Chrome remote debugging without authentication, and a shared Linux user, filesystem and credentials for all agents on an account. Profero says these conditions could expose browser sessions, connected-service access tokens and saved files if an attacker could get a command executed by an agent. It assigns CVSS 3.1 severity scores to seven listed issues, including critical ratings, and says its report contained eight vulnerabilities with reproduction steps and proposed fixes. Profero’s suggested mitigations include removing network access to Docker, authenticating internal services, generating unique per-sandbox credentials, revoking credentials when sandboxes are destroyed, and avoiding production browser sessions and long-lived keys in agent environments.
What the archive adds
New Runtime’s earlier coverage of OpenAI’s Patch the Planet disclosure concerned a separate unauthenticated RCE in Brotli, not Grok Bot or agent sandbox isolation (earlier coverage, October 24, 2026). This is a new event, not a continuation of that vulnerability story. The shared security theme does not establish a technical link between the incidents.
Trend signal
This report supports New Runtime’s pattern that agent security moves to runtime boundaries: permissions, credentials, execution services and isolation determine what a compromised agent can reach. Profero’s account, if confirmed, illustrates why a prompt asking an agent to behave safely cannot substitute for controls around the runtime. The pattern is a useful lens, not independent confirmation of the specific findings.
Why now
Profero says it gave xAI and Cursor notice on August 24, offered pre-publication review, and retested during September and October. It says the findings persisted across more than 240 builds, and that it published after more than 75 days without acknowledgment. The disclosure says it omitted hostnames, credentials, signing keys and proof-of-concept code.
Why it matters
Agent products often combine execution environments with a user’s browser state, files and delegated access to services. If the reported chain is accurate, compromising one command path could undermine several controls at once: the attacker could gain a remote shell in the sandbox, reach the account VM, and obtain credentials or data associated with that account. Shared identity and storage would widen the impact beyond a single agent task.
For teams evaluating hosted agents, the practical boundary is not just whether the model follows instructions. It is also what the runtime exposes to agent code, how credentials are stored and rotated, whether agents are isolated from one another, and what evidence remains available after compromise. Profero recommends treating the sandbox as hostile, using dedicated accounts and narrowly scoped connectors, avoiding production browser sessions and long-lived keys, and monitoring activity outside the sandbox. Those are prudent precautions for agent deployments generally; they do not establish that any particular customer account was accessed.
Limits and uncertainty
The technical claims in the disclosure are Profero’s; neither xAI nor Cursor is quoted confirming them. The post says its researchers tested accounts they paid for, but does not establish that an attacker exploited these weaknesses against customers. Profero says it could not cross from the account VM into the underlying EC2 host, and its public account does not demonstrate cross-customer access. The report describes retesting and omitted exploit details, but the claimed fixes, the vendors’ current status, and any independent verification remain unconfirmed.
Skill to build now
Before a hosted agent rollout, map which identities, browser sessions, files and connector tokens the sandbox can access. Use a dedicated account with the narrowest required permissions, and test whether those credentials can be revoked independently of the sandbox. Ask the vendor how internal services authenticate, whether secrets appear in images or on disk, how agent instances are isolated, and what telemetry is collected outside the environment.
Reader takeaway
An agent sandbox is a security boundary only if its surrounding services, credentials and storage are constrained too. Profero’s Grok Bot findings are not vendor-confirmed, but they make a concrete case for limiting what an agent can inherit from a user account and verifying the runtime before deployment.