独家：Grok Bot 推出休眠共享房间，用于指派其他用户的代理

Finding

SpaceXAI built an unannounced cross-account shared-room system into Grok Bot 0.16.0 that lets owners invite other users, approve access and allow participants to add agents, although SpaceXAI’s servers blocked RuntimeWire’s account from activating sharing.

How we verified

Methods: reverse engineering, testing, public records.

RuntimeWire reverse-engineered Grok Bot 0.16.0 and found interface components and request handlers for creating shared rooms, generating invitation links, requesting and approving access, managing participants and allowing participants to add agents. RuntimeWire rendered the hidden sharing interface and reached SpaceXAI’s live server response: “Sharing isn’t enabled for your account.” Screenshots, extracted code and the original application binary were preserved. SpaceXAI and Cursor received detailed questions before publication and did not respond by the stated deadline.

RuntimeWire preserved the publicly distributed Grok Bot 0.16.0 desktop application and recorded its SHA-256 hash. We unpacked the application, searched its bundled code for sharing-related interface strings and traced components and request handlers connected to the sand_multiplayer feature flag. We mapped the room-creation, invitation, access-approval, participant-management and add-agent flows, then opened the corresponding interface in the application. SpaceXAI’s server rejected activation because sharing was not enabled for the test account. We compared the findings with SpaceXAI’s public launch materials and available documentation.

Tested versions:

• Grok Bot 0.16.0 (desktop)

Reproduction

RuntimeWire partially reproduced the finding.

Company response

The company did not respond to requests for comment.