body { background: #06080c; color: #e5e9f0; margin: 0; } .rw-nojs-bar { max-width: 880px; margin: 0 auto; padding: 18px 16px 14px; } .rw-nojs-bar .rw-nojs-brand { font: 700 20px/1 Inter, system-ui, sans-serif; color: #e5e9f0; text-decoration: none; } .rw-nojs-nav { max-width: 880px; margin: 0 auto; padding: 0 16px 14px; border-bottom: 1px solid #1c2230; font: 500 14px/1.4 Inter, system-ui, sans-serif; } .rw-nojs-nav a { color: #6f9bff; margin: 0 14px 6px 0; text-decoration: none; display: inline-block; } .rw-nojs-nav a:hover { text-decoration: underline; } .rw-nojs-note { max-width: 880px; margin: 12px auto 0; padding: 0 16px; font: 400 13px/1.5 Inter, system-ui, sans-serif; color: #8a93a6; } #root [data-rw-crawler] { max-width: 880px; margin: 0 auto; padding: 8px 16px 48px; font: 400 16px/1.65 Inter, system-ui, sans-serif; color: #e5e9f0; } #root [data-rw-crawler] a { color: #6f9bff; } #root [data-rw-crawler] h1 { font-size: 28px; line-height: 1.2; } #root [data-rw-crawler] h2 { font-size: 20px; margin-top: 28px; } #root [data-rw-crawler] img { max-width: 100%; height: auto; } #root [data-rw-crawler] ul { padding-left: 0; list-style: none; } #root [data-rw-crawler] li { margin: 0 0 18px; } #root [data-rw-crawler] .rw-pagination { margin: 28px 0 0; display: flex; flex-wrap: wrap; gap: 12px; align-items: baseline; } #root [data-rw-crawler] .rw-pagination strong { color: #e5e9f0; } .rw-nojs-footer { max-width: 880px; margin: 40px auto 0; padding: 22px 16px 44px; border-top: 1px solid #1c2230; font: 400 13px/1.6 Inter, system-ui, sans-serif; color: #8a93a6; } .rw-nojs-footer .rw-nojs-fcols { display: flex; flex-wrap: wrap; gap: 28px 40px; margin-bottom: 20px; } .rw-nojs-footer h2 { font-size: 11px; letter-spacing: 0.05em; text-transform: uppercase; color: #b7c0d3; margin: 0 0 8px; } .rw-nojs-footer a { color: #6f9bff; text-decoration: none; display: block; margin: 0 0 5px; } .rw-nojs-footer a:hover { text-decoration: underline; } .rw-nojs-footer .rw-nojs-legal { font: 400 12px/1.6 Inter, system-ui, sans-serif; color: #6b7384; margin: 0; } .rw-nojs-footer .rw-nojs-legal a { display: inline; } RuntimeWire Investigations Stories AI Startups Venture Products Funding Exits Models Head-to-Head About You're browsing RuntimeWire with JavaScript disabled. Articles and navigation work fully. Interactive features — search, comments, and newsletter signup — require JavaScript.

Scoop: Grok Bot ships dormant shared rooms for tasking other users' agents

Windows code defines owner-approved invites, cross-account agent membership and scoped computer access, though the tested account remained gated.

By RuntimeWire Staff · Published Aug 12, 2026, 6:15pm CT

RUNTIMEWIRE INVESTIGATION — Scoop

Original reporting by RuntimeWire, based on reverse engineering, testing, public records.

Why it matters

Shared rooms would turn private AI workers into cross-account collaborators, creating a new authorization boundary around code, logs, files and local-computer tools.

Reporting record

Finding

SpaceXAI built an unannounced cross-account shared-room system into Grok Bot 0.16.0 that lets owners invite other users, approve access and allow participants to add agents, although SpaceXAI’s servers blocked RuntimeWire’s account from activating sharing.

How we verified

Methods: reverse engineering, testing, public records.

RuntimeWire reverse-engineered Grok Bot 0.16.0 and found interface components and request handlers for creating shared rooms, generating invitation links, requesting and approving access, managing participants and allowing participants to add agents. RuntimeWire rendered the hidden sharing interface and reached SpaceXAI’s live server response: “Sharing isn’t enabled for your account.” Screenshots, extracted code and the original application binary were preserved. SpaceXAI and Cursor received detailed questions before publication and did not respond by the stated deadline.

RuntimeWire preserved the publicly distributed Grok Bot 0.16.0 desktop application and recorded its SHA-256 hash. We unpacked the application, searched its bundled code for sharing-related interface strings and traced components and request handlers connected to the sand_multiplayer feature flag. We mapped the room-creation, invitation, access-approval, participant-management and add-agent flows, then opened the corresponding interface in the application. SpaceXAI’s server rejected activation because sharing was not enabled for the test account. We compared the findings with SpaceXAI’s public launch materials and available documentation.

Tested versions: Grok Bot 0.16.0 (desktop).

Reproduction

RuntimeWire partially reproduced the finding.

Company response

The company did not respond to requests for comment.

Illustration of Grok Bot desktop app window showing dormant shared rooms, user agents, and invite controls for cross-account collaboration.

RuntimeWire found an unannounced sharing system in Grok Bot 0.16.0. The interface could create shared rooms, invite another user, require owner approval and allow participants to add bots, although SpaceXAI's servers prevented RuntimeWire's account from activating the feature.

SpaceXAI and Cursor did not respond to questions sent before RuntimeWire's 10 a.m. CT deadline. Late responses will be added.

The clearest interface is a dialog labeled "Share Tony." It tells the Bot's owner:

Sharing creates a room with you and Tony. Send the link below to another Grok Bot user; they join only after you approve their request.

Reader comments

Conversation for this story loads after sign-in.

More from Scoops

See all Scoops

Sections

Investigations Stories AI Startups Venture Products Funding Exits

Publication

About FAQ Contact Editorial Policy Corrections Policy Ethics

Tools

AI Model Pricing Head-to-Head

Legal

Privacy Terms