Scoop: SpaceXAI's Grok Bot stamps an account-derived ID into browser requests

RUNTIMEWIRE INVESTIGATION — Exclusive

Original reporting by RuntimeWire, based on reverse engineering, data analysis, testing.

Why it matters

Grok Bot gives websites a persistent recognition key through routine HTTP metadata, where it can enter server and analytics logs without cookie-style controls.

Reporting record

SpaceXAI's Grok Bot identifies the account behind its cloud browser through a persistent tag embedded in Chrome's user-agent header, RuntimeWire found.

In a live test on August 12th, 2026, a signed-in Grok Bot for Windows opened Httpbingo's user-agent endpoint through its graphical cloud browser. The external server received this header, with the account tag partially redacted by RuntimeWire:

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
GrokAgent/1.0 (u:7558........9b44)

The GrokAgent/1.0 token identifies the software sending the request. The value following u: goes further: it distinguishes the authenticated Cursor (@Cursor) account operating the browser.

The tag does not contain the customer's name, email address, access token or raw Cursor account ID. It is a pseudonymous, account-derived identifier that gives a website a cookie-independent way to recognize later traffic carrying the same value.

RuntimeWire tested one authenticated account. The test establishes that the feature was active for that account and that the identifier reached an unrelated external server. It does not establish how broadly Grok Bot has enabled the behavior.

The identifier comes from account authentication

Inspection of the shipped Grok Bot for Windows 0.16.0 client showed that the application generates the value from the sub claim in the authenticated Cursor account's JSON Web Token. The operative function parses the token, hashes the subject with SHA-256, converts the result to hexadecimal and retains the first 16 characters:

const sub = parseJwtPayload(accessToken)?.sub;
if (sub == null || sub.length === 0) return null;
return createHash("sha256")
  .update(sub, "utf8")
  .digest("hex")
  .slice(0, 16);

The resulting 16 hexadecimal characters represent a 64-bit value. The same JWT subject produces the same tag, including after an access token is renewed, as long as Cursor leaves the account's sub claim unchanged.

Grok Bot writes the hash to /tmp/sand-ua-user during authenticated startup and after token renewal. The temporary file contains the truncated hash, rather than the access token or raw subject.

Code elsewhere in the shipped application describes a GrokAgent user-agent suffix consumed by the cloud computer's Chrome browser. The suffix is applied through a Chrome launch argument and a Chrome DevTools Protocol override for new tabs. That implementation places the tag in standard browser metadata visible to external origins.

A remote switch controls the stamp

The client includes an experiment gate named sand_browser_ua_token_kill_switch. Its bundled default is false, which leaves the stamped user agent enabled. The accompanying source comment says configuration failures and errors reading the gate also fall back to the stamped behavior.

When enabled remotely, the kill switch creates /tmp/sand-ua-token-disabled, preventing the token from being applied to new Chrome launches and new-tab overrides. The control is implemented as a remote experiment switch, rather than a privacy setting exposed in the inspected Grok Bot desktop interface.

The code and live transmission establish what Grok Bot sends. They do not establish why Cursor or SpaceXAI chose an account-level value. Potential operational uses include abuse prevention, rate-limit attribution, fraud detection and debugging failures tied to a particular cloud computer. Those functions could also be implemented with identifiers restricted to company-controlled services instead of a browser field received by unrelated websites.

Cursor says its cloud agents control their own computers, including a browser and graphical interface used to test and demonstrate work. Cursor and SpaceXAI have also publicly described a model-training partnership, and Cursor says Grok 4.5 was trained jointly with SpaceXAI. The Grok Bot Windows package lists SpaceXAI as its author while using Cursor authentication and infrastructure.

The privacy issue is repeat recognition

User-agent product markers are routine for crawlers, automation tools and specialized browsers. They let websites identify software for compatibility, traffic management or blocking. An account-derived suffix changes the granularity from identifying the application to distinguishing one customer account from another.

The identifier cannot authenticate the user and RuntimeWire has not shown that a website can reverse it to recover the underlying Cursor account subject. Its privacy significance comes from stability. A website that records the header can recognize subsequent visits carrying the same tag even if browser cookies are cleared or unavailable.

Cross-site correlation would require the identifier to be observed by a shared service or combined across separate logs. RuntimeWire did not test that scenario.

The HTTP standard's User-Agent guidance advises senders to avoid needlessly fine-grained details because they increase the risk of identifying users through fingerprinting. Chromium pursued user-agent reduction to reduce information passively supplied to websites, freezing several browser and platform details that could contribute to tracking.

RuntimeWire ran the same endpoint test using ChatGPT for Windows' agent-controlled built-in browser. It returned a standard Windows Chrome user agent without a ChatGPT product marker or account-level suffix. OpenAI's documentation says that browser runs inside the desktop application, while Grok Bot's tested browser ran on a managed Linux cloud computer, so the comparison is not a like-for-like industry benchmark. It does show that agent-controlled browser operation does not inherently require placing a persistent customer tag in the user-agent field.