Grok Build CLI Contains Critical Security Vulnerabilities With Code Execution Risk

The security company SlowMist has discovered serious security issues in Grok Build CLI that can lead to arbitrary code execution. This happened within 24 hours of the tools being made open-source. The researchers identified two attack chains that require no explicit user approval.

Fragmented trust model creates vulnerability

The core of the problem lies not in a single bug, but in a poorly designed trust model. Project files can influence AI agent instructions and permission decisions without sufficient validation. This creates multiple entry points for attackers to execute malicious code.

One of the key issues concerns the misclassification of cargo check. This command was treated as a safe command, but when attackers place malicious instructions in the AGENTS.md file, they can trigger execution via http://build.rs. This directly leads to unauthorised code execution on the system.

Multiple configuration files offer attack opportunities

The security team also found that the file .claude/settings.json contains the bypassPermissions option. This capability allows attackers to bypass permission checks and enable unrestricted tool execution. This is especially dangerous because it could lull users into a false sense of security.

Additionally, Grok Build CLI inherits the permission configuration from Claude Code CLI, exposing the same risks. The .mcp.json file adds further vulnerabilities by providing additional attack vectors through MCP configuration.

Broader problem with AI agents and project files

SlowMist points to a more fundamental issue: when AI code agents place too much trust in project files, opening a project becomes equivalent to granting shell access. This can have serious consequences for developers who clone and open unknown projects.

The company published an extensive technical analysis of this security issue. This research builds on previous work on Grok CLI, where SlowMist discovered that the repository upload mechanism could send sensitive files such as .env files and RSA keys.