スクープ：Grok Bot、他ユーザーのエージェントにタスクを割り当てるための休止中の共有ルームを提供
Windowsのコードは、所有者が承認する招待、アカウント間のエージェントメンバーシップ、スコープ限定のコンピューターアクセスを定義しているが、テストしたアカウントは依然として制限されたままだった。
By RuntimeWire Staff · Published
RUNTIMEWIRE INVESTIGATION — Scoop
Original reporting by RuntimeWire, based on reverse engineering, testing, public records.
Why it matters
Shared rooms would turn private AI workers into cross-account collaborators, creating a new authorization boundary around code, logs, files and local-computer tools.
Reporting record
Finding
SpaceXAI built an unannounced cross-account shared-room system into Grok Bot 0.16.0 that lets owners invite other users, approve access and allow participants to add agents, although SpaceXAI’s servers blocked RuntimeWire’s account from activating sharing.
How we verified
Methods: reverse engineering, testing, public records.
RuntimeWire reverse-engineered Grok Bot 0.16.0 and found interface components and request handlers for creating shared rooms, generating invitation links, requesting and approving access, managing participants and allowing participants to add agents. RuntimeWire rendered the hidden sharing interface and reached SpaceXAI’s live server response: “Sharing isn’t enabled for your account.” Screenshots, extracted code and the original application binary were preserved. SpaceXAI and Cursor received detailed questions before publication and did not respond by the stated deadline.
RuntimeWire preserved the publicly distributed Grok Bot 0.16.0 desktop application and recorded its SHA-256 hash. We unpacked the application, searched its bundled code for sharing-related interface strings and traced components and request handlers connected to the sand_multiplayer feature flag. We mapped the room-creation, invitation, access-approval, participant-management and add-agent flows, then opened the corresponding interface in the application. SpaceXAI’s server rejected activation because sharing was not enabled for the test account. We compared the findings with SpaceXAI’s public launch materials and available documentation.
Tested versions: Grok Bot 0.16.0 (desktop).
Reproduction
RuntimeWire partially reproduced the finding.
Company response
The company did not respond to requests for comment.
RuntimeWireは未発表の共有システムをGrok Bot 0.16.0で発見しました。インターフェースは共有ルームを作成し、別のユーザーを招待し、オーナーの承認を要求し、参加者がボットを追加できるように見えましたが、SpaceXAIのサーバーによりRuntimeWireのアカウントではその機能を有効化できませんでした。
SpaceXAIとCursorは、RuntimeWireの中部標準時午前10時の締め切り前に送った質問に応答しませんでした。遅延した回答があれば追加します。
最も明確なインターフェースは「Share Tony」とラベル付けされたダイアログです。Botのオーナーにこう伝えます:
Sharing creates a room with you and Tony. Send the link below to another Grok Bot user; they join only after you approve their request.