Grok Bot Windows — in-app update downloads then fails Authenticode probe (installer_signature_invalid)

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Grok Bot

Describe the Bug

On Windows, Grok Bot’s in-app updater downloads a new installer, then refuses to install it. Settings show: “다운로드한 업데이트를 확인할 수 없어 설치되지 않았어요” (The downloaded update could not be verified, so it was not installed.)

The app version stays on the old build. Seen on 0.36.0 stuck while 0.39.0 was current (2026-09-04), and again on 0.44.0 stuck while 0.47.0 was current (2026-09-10). %LOCALAPPDATA%\sand-updater\installer.exe remains the already-installed version.

The official Setup.exe from Cursor · Download Grok Bot has Authenticode status Valid and signer “Anysphere, Inc.” and installs correctly when run manually (Setup.exe /S).

This is desktop app update, not Agent Computer image update/reset.

Steps to Reproduce

  1. Install Grok Bot on Windows x64 (stable track, auto-update on).
  2. Wait until a newer stable is published on the official Grok Bot download page.
  3. Open Settings → Updates → Check for Updates (or wait for auto-update).
  4. Download progress appears, then the unverified-install error. App FileVersion does not change.

Expected Behavior

After a successful download, the signed installer should be staged and applied on quit/restart, matching the version on the download page.

Operating System

Windows 10/11

Version Information

Grok Bot 0.47.0 (Windows x64), currently installed after a manual official Setup.exe. Previously stuck at 0.36.0 then 0.44.0. Windows 11 10.0.26200.

Additional Information

0.47.0 app.asar still contains the same probe: Get-AuthenticodeSignature via powershell.exe -NoProfile -NonInteractive -Command, then JSON.parse of stdout, requiring status === “Valid” and signer in [“Anysphere, Inc.”, “Anysphere”]. Failure kind: installer_signature_invalid (UI id VZlSAx). On failure the downloaded file is deleted.

Anysphere installers use short-lived Microsoft ID Verified / Azure Trusted Signing certificates (~3 days) plus a timestamp. Get-AuthenticodeSignature from an interactive PowerShell session still returns Valid after NotAfter because of the timestamp. The in-app Electron execFile(“powershell.exe”, …, { windowsHide: true }) path can still fail (unreadable JSON, status not exactly Valid, unexpected SimpleName), which matches “download happened, install never started”.

Suggested fix: verify with WinVerifyTrust / timestamp-aware Authenticode without parsing PowerShell JSON; do not delete a just-downloaded installer on a probe parse error; don’t treat Agent Computer reset as the recovery path for this desktop-app failure.

Official installer that applied cleanly (0.47.0):
https://downloads.cursor.com/grokbot/stable/win32-x64/0.47.0/Grok_Bot_0.47.0_Setup.exe

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hey @aiaje_com, thanks for the detailed report.

Your read is right: the in-app updater downloads the new installer, the verification step fails, and the file is removed, so the app stays on the old version.

From what we can see the same verification has gone through on your machine on other days, so the signing certificate itself is not the problem. It looks like something about the moment right after the download finishes (for example an antivirus still holding the file, or the check taking too long).

For now, installing the Setup.exe from Cursor · Download Grok Bot is the right workaround. Your Agent Computer does not need a reset or update for this, it is only the desktop app.

If you have a minute, one check would help us narrow it down. In a normal (non-admin) PowerShell window, run this against the installer you downloaded, replacing the path:

Measure-Command { powershell.exe -NoProfile -NonInteractive -Command "$ErrorActionPreference='Stop'; $sig = Get-AuthenticodeSignature -LiteralPath 'C:\Path\To\Grok_Bot_0.47.0_Setup.exe'; [pscustomobject]@{ status = $sig.Status.ToString(); signer = $sig.SignerCertificate.GetNameInfo('SimpleName', $false) } | ConvertTo-Json -Compress" | Out-Host }

Please reply with the JSON line it prints, the TotalSeconds value, and which antivirus or endpoint security product runs on that PC (Defender, V3, ALYac, etc.). If you can, also note whether the antivirus was scanning the next time an in-app update fails.

8

Same issue here on Windows 11 x64, stable track, Grok Bot 0.61.0 → 0.66.0. The in-app updater downloads the installer, then reports “the downloaded update could not be verified” and doesn’t install. This has been happening on every update for a long time.

This is not environment-specific. I checked the leftover installer.exe (about 112 MB) with Get-AuthenticodeSignature: Status is Valid and the signer is Anysphere, Inc. Defender is on and nothing else interferes. Running the same installer manually works fine.

So the file is fine and the failure is in the app’s own verification step. This thread already describes where it fails: the in-app check that calls powershell.exe and parses its JSON output. It looks like a contained, reproducible bug, yet in-app auto-update on Windows still doesn’t work.

Is there a known reason it hasn’t been fixed, and is there a tracking issue or an ETA? Right now every Windows user has to reinstall by hand. Could the updater at least log why verification failed, so users can report something more useful than this message?