Grok Bot computer silently restored to a Sep 28 snapshot overnight — 3 days of box files (Sep 29–Oct 1) lost, no Update/Reset pressed

Support Bug Reports
1

Where does the bug appear (feature/product)?

Grok Bot

Describe the Bug

Grok Bot’s computer (the shared cloud box) rebooted at 2026-10-02 00:00:39 ET and came back with its files rolled back to about 2026-09-28 20:59 ET. Everything written Sep 29 – Oct 1 is gone. Nobody asked for a reset, restore, or update. I don’t recall pressing Update or Reset for Grok Bot’s computer overnight.

What we saw on the box (checked 12:54 PM ET, Oct 2):

  • Uptime: booted 2026-10-02 00:00:39 ET.
  • Every file in one project folder (221 files) has an mtime between 2026-09-28 20:59:29 and 20:59:45 ET. That includes files whose names show they were made Sep 17–28. They were all rewritten within about 16 seconds, which looks like a restore from a Sep 28 ~20:59 ET snapshot.
  • Files and folders created Sep 29 – Oct 1 are missing:
    • one bot’s watcher/ folder (Python watcher, helper module, ensure-running script, state files)
    • a Python venv under /workspace
    • a user skill folder under /home/box/agent-data/workflows/
    • a different bot’s file under /workspace (created Sep 30). Two bots lost files, so this is machine-wide, not one agent.
  • A search for files with mtime between 2026-09-29 and 2026-10-02 under /workspace and /home/box finds only 28 files. All are Chrome component updates (CertificateRevocation, Crowd Deny 2026.10.1.64). Almost no user data from that window survived.
  • The rollback covered most of /home/box. The affected bot also found these back at mtimes of Sep 28 20:55–20:59 ET: its workspace, agent-data transcripts, the connector-secrets folder, rules, mcp-wrappers, search-index.db, and user skills. An SSH setup created Sep 29 – Oct 1 was lost too.
  • Another bot saw host-managed files rewritten again around 10:32 ET on Oct 2.
  • These survived: environment secrets and server-side routines.

Timeline (ET):

  • Oct 1 ~18:31: the affected bot’s ship alerts stop.
  • Oct 2 00:00:39: box boots.
  • Oct 2 05:43: the bot’s scheduled health check says its watcher is healthy after a restart.
  • Oct 2 ~10:32: another bot sees host-managed files rewritten again.
  • Oct 2 12:49: the watcher files are confirmed missing.
  • Oct 2 ~14:27: the bot rebuilds its watcher; alerts resume. Impact window: about 18:31 ET Oct 1 to 14:27 ET Oct 2 (~20 hours).
    I changed some webhook URL settings around that time. I don’t think it’s related.

Steps to Reproduce

I can’t reproduce this on demand. What happened:

  1. Use Grok Bot normally Sep 29 – Oct 1; bots create files under /workspace and /home/box.
  2. Overnight Oct 1–2 the box reboots (00:00:39 ET). Nobody asked for an Update or Reset.
  3. After boot, the files match a ~Sep 28 20:59 ET state, and everything from Sep 29 – Oct 1 is gone.

Expected Behavior

A rebuild, migration or restore should bring back the latest backup (“files are continuously backed up and restored on every rebuild”, per staff in #169847), not one 3+ days old. If only an old backup exists, the user should be warned before it’s restored.

Screenshots / Screen Recordings

not attached (no UI error to show; the evidence is file timestamps)

Operating System

Linux

Version Information

Grok Bot (iOS): 1.13.1 (15504) · runtime bdf8bab6342e08ac7e7926bce8c63e48b7271724 · embedded bundle · channel production
Grok Bot (desktop): Grok Bot 0.66.0 (built 2026-10-01T18:23:52.620Z, stable, darwin)
Bot name: HeadsUp (formerly River Rubbernecker) — Conversation ID c3c70199-a8d9-4576-af63-826c615fbb77
Reporting bot conversation ID: 2d28dc6b-2e68-43b1-8974-cf75a08ad260
Surface: cloud computer (machine-wide)

Additional Information

Questions for staff:

  1. Why did a restore use a 3-day-old snapshot (~Sep 28 20:55–20:59 ET) instead of a recent backup?
  2. Please check your logs: what ran on this account’s computer overnight Oct 1–2, roughly Oct 1 18:31 ET to Oct 2 00:01 ET? A snapshot restore, rebuild, image migration (#173562 shows d774917 → d53a5cc going out around 20:05 ET Oct 1), or host move? I don’t recall starting one. Please also check what rewrote host-managed files around 10:32 ET Oct 2.
  3. Did backups stop around Sep 28 ~21:00 ET (like #172343, where backups stopped after a lost connection)? Is a newer backup with Sep 29 – Oct 1 data available?
  4. How can we protect box data from this? Is there a way to see when the last backup ran, or to be warned before a stale restore?

Related (not duplicates):

In-app SendFeedback also submitted for this report.

Cloud computer snapshot (collector, redacted)

captured 2026-10-02 12:55 ET · Linux 6.12.94+ x86_64 · Debian 13.7 (trixie) · 8 vCPU Intel Xeon · Mem 15Gi (used 11Gi, avail 4.3Gi), no swap · overlay / 126G, 16G used (14%) · uptime 12:54, booted 2026-10-02 00:00:39 ET · node v20.19.2, python 3.13.5, git 2.47.3

Does this stop you from using Cursor

No - Cursor works, but with this issue