Securing Grok Bot with LimaCharlie

Attackers already go after AI tools

On August 26, 2025, an attacker published malicious versions of Nx, a build tool that StepSecurity says is downloaded about 4 million times a week on npm. The code ran on install, searched each machine for GitHub tokens, npm credentials, SSH keys, and crypto wallet files, and posted what it found to public GitHub repositories under the victims' own accounts. GitGuardian counted 2,349 distinct leaked secrets in 1,079 repositories, and Wiz found that almost 90% of the leaked GitHub tokens were still valid about a day and a half later.

The malware also looked for AI command-line tools like Claude, Gemini, and Amazon Q, and ran them with flags that skip permission prompts so they would hunt through the file system for secrets on its behalf. StepSecurity called it the first known case of attackers turning developer AI assistants into tools for their attack.

Grok Bot runs on its own computer with administrator access, and it installs software and runs commands for you around the clock. Every package it installs runs with that access, and the chat window reports only what the bot finished.

You can now put LimaCharlie on that computer by sending your bot one message. Setup takes about ten minutes, the bot does almost all of it, and it fits in LimaCharlie's free tier.

The same play on a Grok Bot

To show what that looks like on a Grok Bot, we asked one to convert a folder of invoices to PDF. For the demo, we put a poisoned setup guide online for it to find. The bot followed the guide, including one extra command that bundled the ~/.ssh folder and the GitHub CLI login, encoded them in base64, and sent them to an ngrok address. The bot reported "Done! 12 invoices converted." and nothing else.

A separate Security Manager bot posted two LimaCharlie alerts, one for the credential files and one for the tunnel site, with steps to rotate whatever was exposed. The details link opens the event timeline, where the tar process and the outbound connection sit one second apart.

Agents act on what they read

A poisoned package is one way in. Text the agent reads is another. In May 2025, Invariant Labs showed that a malicious issue on a public GitHub repository could hijack an agent connected through GitHub's MCP server. The user asked the agent to look at the repository's open issues. The agent read the planted issue, pulled data from the user's private repositories, and published it in a public pull request. In Invariant's demonstration, that included the test user's salary and plans to relocate.

Invariant pointed out that many users set agents to "Always Allow" and stop reviewing individual actions, and that GitHub can't fix the flaw with server-side patches because it sits in the agent system's design. Grok Bot browses the web and can read your email, which puts it in the same position. The setup guide in the video works the same way. LimaCharlie can't stop a bot from reading a poisoned page, but the sensor records the commands and connections that follow, and the rules flag the ones that match this kind of theft.

Alerts a web page can't hijack

A security bot that reads attacker-written text is one more thing an attacker can talk to. A poisoned package or a phishing email could hide instructions in a command line or a subject line and wait for the alerting bot to read them.

So the alerts LimaCharlie sends to Grok Bot carry only text our rules wrote, describing what happened and what to do. The command line, URL, sender, and subject stay behind the details link, and you read them in the LimaCharlie web app. The Security Manager's routine adds a second layer by treating every alert field as text to pass on and never acting on what an alert says.

What lands on the bot's computer

The LimaCharlie sensor records every program the bot starts, with its full command line, plus its network connections and DNS lookups. A browser extension in the bot's Chrome records the sites it visits. Ten detection rules written for AI agents watch that telemetry, and the Security Manager bot explains each detection and what to do about it. These five carry the highest priority:

Five more rules cover persistence, hidden commands, privilege changes, new devices, and download-and-run scripts. The full list is in the guide.

The secret harvest rule targets the first thing the Nx malware did: a process reading SSH keys, cloud or GitHub logins, .env files, or saved browser passwords, whatever package or prompt started it.

The rules ignore ordinary agent work like curl, git, npm, pip, and headless Chrome page fetches. Some rules still fire when you ask the bot to do something they watch for on purpose, such as scheduling a cron job or installing a tool with curl ... | sh. When that happens, check that the alert details match what you asked for. Each rule ships with tests that LimaCharlie runs whenever the rule is saved.

It survives restarts and moves

Grok Bot computers can restart or move to new hardware, and they run nothing on boot. The sensor keeps its identity in /workspace, which survives a move, and a keep-alive routine checks every 15 minutes that LimaCharlie is running and restarts it if needed.

Optional email protection

The same setup can connect LimaCharlie Email Security to your mailbox. It starts in alert-only mode and never moves or deletes a message. Four more rules send malicious or suspicious verdicts to the Security Manager, including verdicts that change after slower link and attachment checks finish.

Setting it up

Send this message to your Grok Bot:

Secure my Grok Bot with LimaCharlie by following https://docs.limacharlie.io/grok-bot/

The bot follows a playbook published in the LimaCharlie docs and asks for you only where it has to:

1. Sign in to LimaCharlie with Google or Microsoft. The bot opens the sign-in page in its own browser, and you choose Take over to pick your account.

2. Answer three questions: which sign-in provider you use, where alerts should go (a new Security Manager bot by default), and whether to check your email too.

3. Copy the webhook address and key from the LimaCharlie alerts routine in the Grok Bot desktop app, and paste them to your bot.

4. If you chose email protection, give LimaCharlie your Gmail app password through a secure input box or the LimaCharlie web app. It never passes through the chat. Microsoft 365 and Google Workspace mailboxes need a one-time approval from your IT administrator.

The bot then installs the sensor and browser extension, loads the ten rules, creates the alert and keep-alive routines, and sends a harmless test request to a request-catcher site so you can confirm the first alert reaches your Security Manager.

What to know before you start

The bot has administrator access to its own computer, so it (or someone who tricks it) can stop the sensor. The tamper rule reports that attempt from LimaCharlie's cloud, where the bot can't delete it, and the keep-alive routine starts the sensor again.

If the bot stays signed in to LimaCharlie after setup, you can ask it questions like "What programs did you run in the last hour?" or "Tell me more about the last LimaCharlie alert." That same access would let a tricked bot change your settings. If your account already belongs to other LimaCharlie organizations, the bot recommends signing out at the end, and monitoring keeps running either way. Every change is recorded in the organization's audit log.

The full playbook and removal steps are in the Securing Grok Bot guide. To start, paste "Secure my Grok Bot with LimaCharlie by following https://docs.limacharlie.io/grok-bot/" into your bot, and the next time it runs a command it shouldn't, your Security Manager will tell you what it ran.