Omri Segev Moyal

Cyber incidents are always crazy. But this one goes to the record book. The rabbit hole went so deep and we are only able to scratch the surface publicly:

אוקיי נושא הסוללה דיי התייצב, בחוויות השימוש הייתי מעל ל30% פחות זמן בלפטופ ועבדתי הרבה יותר רצוף. אפשר לקחת פגישה כמעט מכל מקום וזה לא נראה מוזר ואפילו נוח. טיפה מציק נושא האפליקציות שלא מותאמות למכשיר אבל לא קריטי. רוב האפליקציות החשובות תומכות. אפשר לסכם את שבוע העבודה עם המכשיר בהצלחה מרובה. לא חושב שאצליח לחזור אחורה. מחכה לגרסה הבאה או זאת שאחריה.

If you want the tokens for your @bot VMs from mac and your unique pod url just grabbed them like this:

grep -rEoha 'nto-[a-z0-9]{16,}' "$HOME/Library/Application Support/Grok Bot" | sort -u

grep -rEoha '[a-f0-9]{16,20}-pod-[a-z0-9-]+-[0-9]+\.us[0-9]+\.cursorvm\.com' "$HOME/Library/Application Support/Grok Bot" | sort -u

Rest is in our blog.

Two days, two @grok products, one lesson about the rush to AI tools

Yesterday @3pun0x from Claroc published his research on Grok’s app builder. Different product from the one we tore apart, different attack, different victims. Same reason it happened.

Let’s connect the dots.

August 2026. Grok Bot. A customer asked us to check xAI’s new agent before rollout. Grok Bot gives an AI a real Linux machine in the cloud: shell, browser, desktop, your logins. Good product. We asked one question: what happens when the agent runs one hostile command?

Everything happens. One request from inside the sandbox to an open Docker API and you’re root. Copy two strings off the disk, add a password that is literally the word local, hard-coded in every sandbox image ever shipped, and you can run commands in that sandbox from any laptop on the internet. The user’s imported cookies sit in a plaintext file. In our test, 351 of them across 86 domains, banks and identity providers included. The token for the connected Google account passes in the clear, so we read our own mailbox and drive through the agent’s connectors. When xAI rotates it, you catch the new one in under a minute. No login, no audit log. A rootkit built from the product’s own parts.

Eight vulnerabilities, CVSS up to 9.6, with fixes. We sent it to xAI and to Cursor, which runs the sandboxes, on August 24.

September. October. xAI rebuilt the fleet, moved our sandbox to a new region, rotated signing keys five times, shipped 243 new builds. About seven a day. Not one touched a finding. Cursor sent an automated bounty-portal reply. xAI sent nothing. We published on November 8, 75 days in.

November 8, same day. Grok Build. Asaf was working through hostnames under grok.me, where Grok publishes the apps people describe to it in chat. He opened 43,551 from an incognito window. 35,578 of them, 94.7%, opened for anyone.

The first was a confidential onboarding plan for a new hire on xAI’s own sales team. Then a territory map of 594 strategic accounts. Then an X ad proposal to a US federal agency, marked confidential. 24 apps by xAI and X staff. Plus 30 other organizations, 6 of them Fortune 500: a hospital’s roster of 3,500 staff, an ICU patient’s labs and ventilator status, a fire department’s shift board with badge numbers, a timesheet app with every employee’s password in the JavaScript.

Why? When you click Publish, Grok preselects “Anyone with the link.” And when Asaf asked for a customer list “for my sales team of 4,” Grok added a Google sign-in on its own, then wrote code that adds whoever signs in to the team before checking membership. Any Google account on earth could read and delete the customers.

Same thing. Exactly the same thing. Our agent trusts whatever command it’s given. Asaf’s builder trusts whoever shows up. Both built on the premise that the thing in front of the AI is a friend.

Notice the response. xAI answered Asaf’s finding, to a reporter: apps are private until published, publishing takes several clicks, employee accounts default to “Only you.” Then it took down its own 24 apps and left 35,000 others open. So Asaf is emailing hospitals himself. We got the same treatment, minus the reporter.

I’m not writing this to beat up on @SpaceXSI . OK, a little. But they renamed themselves SpaceXSI mid-way through, so there are bigger things going on there than our email. That’s the point. Seven builds a day is impressive. Seven builds a day with local in every one of them is seven copies of the same mistake.

And it’s not an xAI thing. Agent sandboxes, app builders, vibe-coding tools, all shipping on the same schedule, all with defaults that say yes. The users aren’t security people. It’s a sales manager and a nurse, because it takes four minutes and IT doesn’t have to know. Yesterday the app was a lunch poll. Today it holds patient data.

What to do. If your people use AI agents: the sandbox is a hostile machine. No production browser sessions, no personal cookies, no long-lived keys. Give the agent its own account with the narrowest connectors you can live with. Monitor from outside, because the box’s own logs belong to whoever is inside it.

If your people build apps with AI, and they do: find out which builders. Search passive DNS for grok[.]me and the rest, open what you find in incognito. Anything internal should error for a stranger. Test the sign-in from an outside account. Read the script files for passwords. Unpublish what nobody owns.

And ask any AI vendor two questions before you sign. What’s the default when I publish? When a researcher emails your security team, who answers?

For one of the biggest names in AI, the answers today are “everyone” and “nobody.”

One more thing. Claroc is in the middle of a round. If you’re an investor and read this far, go talk to @3pun0x . A team that finds 35,000 open apps, reports it properly, then emails the hospitals one by one because the vendor won’t, is not a regular team.

חצי ממגדלי אלון א גייסו להגן מסוכנים וחצי ממגדלי אלון ב גייסו לתקוף עם סוכנים. 90% יסגרו לפני ראונד B.