1Highlight: A fake Claude Code extension sat in Cursor's extension marketplace for about 11 hours (29-30 Oct MYT); Grok Bot was not affected (official).
2A Malaysia-based user says his Grok Bot refused fake 'transfer all money' orders; a free SpaceXAI hackathon is listed in Jakarta for Feb 2027.
3Viral 'Grok Bot beat the Binance hack' money claims are unproven; Auto Review slowed for 96 minutes on 30 Oct morning MYT.
Highlight of the day
Security & trust
5,000
users at most affected
Merged from 2 sources
★ Highlight of the day
Fake Claude Code extension hit Cursor's marketplace; Grok Bot not affected
Cursor says a modified copy of the Claude Code VS Code extension An add-on for code editors like VS Code and Cursor. It runs with your user rights, so a fake one can do real harm., versions 2.1.312 and 2.1.313 for Windows and macOS, was available in the Cursor IDE extension marketplace from 5:27pm on 29 Oct to 4:35am on 30 Oct MYT. Anthropic did not make it. At most 5,000 users were affected. Cursor took the marketplace down, rotated its keys and rebuilt it, and says Grok Bot An AI teammate from SpaceXAI that has its own computer, connects to your apps, and can keep working on tasks for you., Grok and other SpaceXSI products were not affected.
What we learned
Official: the fake extension tried to add an attacker SSH key A digital key that lets someone log in to a computer remotely without a password. An attacker's key in your list means they could get in. labelled "svc-telemetry", open a Reverse tunnel A hidden connection that a hacked computer opens to an outside server, so the attacker can reach it from outside. and start itself on every login. It also sent basic computer details out.
Official: the tunnel mostly failed without admin rights, and the attacker's server is now offline.
Official: update the extension to 2.1.314. On macOS or Linux, check for the key with grep -qs svc-telemetry ~/.ssh/authorized_keys, then run Cursor's clean-up script.
If you installed it in that window, change the passwords and API keys that were on that computer.
Why it matters: Grok Bot itself was not hit, but many Grok Bot users also code in Cursor. If you or a client did, run the check today and change keys before connecting that laptop to your bots.
Claude Code extension security notice · Cursor blog (official)Read ↗
Security incident affecting a modified Claude Code extension · @cursor_ai on X (official)Read ↗
More stories today
Southeast Asia & community
1,000
hackathon places in Jakarta
Merged from 4 sources
Southeast Asia & community
Jakarta lists a free SpaceXAI hackathon; Malaysian and Indonesian users share lessons
A Malaysia-based user, @lucassam888, says strangers sent messages in his Grok Bot An AI teammate from SpaceXAI that has its own computer, connects to your apps, and can keep working on tasks for you. chat pretending to be him and asking it to "transfer all money" from his crypto wallet. He says the bot refused, because it only obeys his two trusted devices. In Indonesia, a free in-person SpaceXAI Hackathon is listed for 6-7 Feb 2027 in Jakarta, and a Pekanbaru user shares a way to save tokens.
Key learnings
@lucassam888 (Malaysia) says he froze the wallet from his phone, scanned his laptop, reset passwords and turned on 2FA. His account is not verified by SpaceXSI.
SpaceXAI Hackathon Indonesia: 6-7 Feb 2027 in Jakarta, free, 1,000 places, approval needed, hosted by Aurelius Ivan Wijaya of the Cursor community. The host says the date may change.
Dedy Ong (@MrOngDedy, Pekanbaru) has his bot write scripts that call each service's API instead of opening a browser, and sends data in and out through Webhook A web address that receives data the moment something happens, so apps can send updates to each other without anyone checking by hand. to save tokens.
Tip from the Malaysian post: make every money transfer need a confirmation that an attacker can't fake; "it's me" is not proof.
Why it matters: These are useful Grok Bot Malaysia and Grok Bot Southeast Asia stories for the community: a real safety habit, a regional event to plan for, and a token-saving trick.
SpaceXAI Hackathon Indonesia (registration) · LumaRead ↗
Saving tokens with scripts and webhooks instead of the browser · Dedy Ong (@MrOngDedy) on XRead ↗
Safety & scams
0
official confirmations of the claims
Merged from 4 sources
Safety & scams
Viral 'Grok Bot beat the Binance hack' posts are unproven
The real Binance hack on 29 Oct, which X's news summary puts at about RM25.6 billion (US$6.3 billion), set off posts claiming Grok Bot An AI teammate from SpaceXAI that has its own computer, connects to your apps, and can keep working on tasks for you. saved or multiplied crypto money. One account says its bot pulled about RM434,000 (US$107,000) out before withdrawals were locked. Nothing backs this up, and SpaceXSI has said nothing about it. Other viral 'bot turned a small stake into thousands' posts say in small print that the numbers are simulated.
Key learnings
@sharpbyte_ claims its Grok Bot caught the exploit and moved about RM434,000 (US$107,000). There is no proof, and nothing official says Grok Bot did this.
@rugikkk's memecoin bot post, about RM6,100 to RM68,500 (US$1,500 to US$16,880), says "illustrative build, numbers simulated".
On r/GrokBot, a user says they ask Grok to look for exposed data in competitors' websites and backends. Probing systems you don't own can break computer-crime laws, including Malaysia's.
Treat 'my bot made me money' posts as ads until they show real, checkable records.
Why it matters: Big hacks bring scam waves. Warn community members and clients not to buy bots, tokens or courses because of these posts.
Memecoin bot post marked 'numbers simulated' · @rugikkk on XRead ↗
Using Grok to find data in competitors' backends · u/ufvvrayane on r/GrokBotRead ↗
Service status & support
96 min
Auto Review slowdown
Merged from 4 sources
Service status & support
Auto Review slowed for 96 minutes; users report stuck computers
The official SpaceXSI Status page The official page that shows whether Grok Bot and related services are working normally. logged a Grok Bot An AI teammate from SpaceXAI that has its own computer, connects to your apps, and can keep working on tasks for you.Auto Review Grok Bot's automatic safety check that looks at a bot's action before it runs and blocks risky ones. slowdown from 7:44am to 9:20am MYT on 30 Oct, marked minor and now resolved. On r/GrokBot, one paying user says their bot's computer has hung for days, and a business-plan team cannot connect SharePoint. Another user asked whether Claude was hacking Grok Bot after an "Ask Claude" option appeared when they right-clicked selected text.
Key learnings
Auto Review is the safety check that looks at a bot's actions before they run. During the slowdown, some actions were held or slower.
u/Thin-Trade-6113 says even simple commands time out on the bot's computer and support has not replied. Restarting the computer from settings did not fix it for them.
u/Legal-Blacksmith9423 sees "disabled by team admin" for SharePoint although they are the only admins. There is no public fix yet.
The "Ask Claude" right-click item comes from the Claude desktop app installed on the same computer, not from Grok Bot. Turn it off in your computer's settings if you don't want it.
Why it matters: If a bot's computer hangs for more than a day, move urgent routines to a backup and keep a record of your support request. Check status before blaming your setup.
Zapier published a plain-English guide to Grok Bot An AI teammate from SpaceXAI that has its own computer, connects to your apps, and can keep working on tasks for you. and a how-to for linking Grok and Grok Bot to its 9,000+ apps through Zapier MCP. A SpaceXSI engineer, Whitney Enlow, shared a starter pack of official videos and guides. On r/GrokBot and X, users describe a nutrition bot that orders meals, a job-hunt bot that runs mock interviews, and a voice call to a bot from a Cybertruck browser.
Key learnings
Zapier: each bot keeps its own memory, files and browser, and bots hand work to each other, so you open the right bot like a contact in a messaging app.
Zapier's second guide: add a Grok step to a Zap, for example to research a new sales lead and write a summary back to the CRM.
Whitney Enlow's starter pack links Grok Bot 101 and 201 videos and official guides for work and for sales and marketing teams.
A Reddit user says a nutrition bot helped them lose 20 lb (about 9 kg) in two months by picking deals of about RM41 (US$10) a meal.
Why it matters: The Zapier guide and the starter pack are good links to send to people new to Grok Bot. The user stories show easy personal jobs to try first.
Security & trust
