Primicia: Grok Bot lanza salas compartidas inactivas para encargar tareas a los agentes de otros usuarios
El código de Windows define invitaciones aprobadas por el propietario, membresía de agente entre cuentas y acceso a equipos con alcance limitado, aunque la cuenta probada permaneció restringida.
By RuntimeWire Staff · Published
RUNTIMEWIRE INVESTIGATION — Scoop
Original reporting by RuntimeWire, based on reverse engineering, testing, public records.
Por qué importa
Las salas compartidas convertirían a los trabajadores de IA privados en colaboradores entre cuentas, creando un nuevo límite de autorización alrededor del código, los registros, los archivos y las herramientas del equipo local.
Reporting record
Finding
SpaceXAI built an unannounced cross-account shared-room system into Grok Bot 0.16.0 that lets owners invite other users, approve access and allow participants to add agents, although SpaceXAI’s servers blocked RuntimeWire’s account from activating sharing.
How we verified
Methods: reverse engineering, testing, public records.
RuntimeWire reverse-engineered Grok Bot 0.16.0 and found interface components and request handlers for creating shared rooms, generating invitation links, requesting and approving access, managing participants and allowing participants to add agents. RuntimeWire rendered the hidden sharing interface and reached SpaceXAI’s live server response: “Sharing isn’t enabled for your account.” Screenshots, extracted code and the original application binary were preserved. SpaceXAI and Cursor received detailed questions before publication and did not respond by the stated deadline.
RuntimeWire preserved the publicly distributed Grok Bot 0.16.0 desktop application and recorded its SHA-256 hash. We unpacked the application, searched its bundled code for sharing-related interface strings and traced components and request handlers connected to the sand_multiplayer feature flag. We mapped the room-creation, invitation, access-approval, participant-management and add-agent flows, then opened the corresponding interface in the application. SpaceXAI’s server rejected activation because sharing was not enabled for the test account. We compared the findings with SpaceXAI’s public launch materials and available documentation.
Tested versions:
- Grok Bot 0.16.0 (desktop)
Reproduction
RuntimeWire partially reproduced the finding.
Company response
The company did not respond to requests for comment.
RuntimeWire encontró un sistema de uso compartido no anunciado en Grok Bot 0.16.0. La interfaz podía crear salas compartidas, invitar a otro usuario, requerir la aprobación del propietario y permitir que los participantes agregaran bots, aunque los servidores de SpaceXAI impidieron que la cuenta de RuntimeWire activara la función.
SpaceXAI y Cursor no respondieron a las preguntas enviadas antes de la fecha límite de las 10 a.m. CT de RuntimeWire. Se agregarán respuestas tardías.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.