Kaspersky HTTPS scanning makes Grok Bot 0.59.1 on Windows fail every API call with ConnectError.Internal and leak over a thousand connections

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Grok Bot

Describe the Bug

Grok Bot 0.59.1 opens and stays signed in, but it cannot reach the agent computer. The same failures start within about one second of every launch. Restarting does not help.

Kaspersky Premium is scanning encrypted connections and presenting its own certificate. For https://api2.cursor.sh the issuer was:

O=AO Kaspersky Lab, CN=Kaspersky Anti-Virus Personal Root Certificate

Subject: CN=api2.cursor.sh

Grok Bot trusts only public CAs, so it drops the connection before the request is sent and logs ConnectError.Internal. Curl and the browser still work because they trust the Windows certificate store.

While retrying, one Grok Bot process held about 1,240 established HTTPS connections, then about 1,430, and the count was still rising.

Log evidence, 26 Sep 2026, about 19:22 and again at 19:39 (Asia/Calcutta):

  • sand-access / entitlement-read: ConnectError.Internal
  • cursor-auth / profile-fetch: ConnectError.Internal
  • cursor-profile / privacy-mode, teams-membership, team-policy-read, hard-limit: ConnectError.Internal
  • box-host / run-state: ConnectError.Internal
  • sand.box_reachability: outcome=network, cause=ControlPortCallError, base_url_kind=unknown (getHostStatus, listAgents, getTrays)
  • sand.box_migration_watch: phase=dropped, error_class=Internal, consecutive failures past 187
  • sand.box_setup_visible: trigger=first_connect, outcome=abandoned (about 1.8s)
  • sand.box_recreate_visible: trigger=manual_reset, outcome=failed (about 0.5s)
  • sand.box_secrets.push: error_class=host_unreachable
  • sand.update.check: TypeError, cause=fetch_throw, error_code=SAND-E0501
  • local-exec / credential-post: TypeError
  • crashSeen=false. No Crashpad dump.

Steps to Reproduce

  1. Install Kaspersky Premium 21.26 on Windows. Leave encrypted-connection scanning at the default: Scan encrypted connections upon request from protection components.
  2. Confirm avp.exe is running.
  3. Install and sign in to Grok Bot 0.59.1 (Stable).
  4. Launch Grok Bot.
  5. Within about one second, profile, entitlement, and agent-computer calls fail with ConnectError.Internal, and base_url_kind stays unknown.
  6. Watch the main Grok Bot.exe process. Established HTTPS connections climb past 1,000.

Checks that show the network itself is fine:

  • https://grok.com returns HTTP 200.
  • curl.exe --noproxy "*" -I https://test123.us10.cursorvm.com returns HTTP/1.1 404 Not Found, Server: awselb/2.0.
  • The certificate for https://api2.cursor.sh is issued by Kaspersky’s personal root, not a public CA.

Expected Behavior

Grok Bot should connect to the account API and the agent computer. If a local HTTPS scanner substitutes a non-public certificate, the app should report a certificate-trust error that names the issuer, and it should stop retrying instead of opening more than a thousand connections.

Operating System

Windows 10/11

Version Information

Grok Bot:
Version: 0.59.1
Release Track: stable
OS: win32 10.0.26300
Runtime: Electron 42.1.0, Chrome 148.0.7778.97, Node 24.15.0
Internal release: [email protected]

For AI issues: which model did you use?

Not an AI-model issue.

For AI issues: add Request ID with privacy disabled

No request ID was issued. The calls failed locally before a request was sent.

Additional Information

  • CPU: AMD Ryzen 5 4600H. Time zone: Asia/Calcutta. Account was signed in.
  • System proxy was off. Firewall profiles were on. No hosts-file overrides for Grok or x.ai.
  • This matches the earlier 0.44.0 Kaspersky report. It still reproduces on 0.59.1.
  • Workaround that worked: leave global scanning on. In Kaspersky, open Network settings → Configure trusted applications. Add C:\Program Files\Grok Bot\Grok Bot.exe. Set Do not scan all traffic to Active. Fully quit Grok Bot and open it again.
  • After that relaunch at 19:50 local: signed in, window maximized, crashSeen=false, connections stayed around 7, the ConnectError.Internal spill log was not recreated, sand-statsig-bootstrap.json refreshed (it had been stuck on 9 Sep 2026 because of SAND-E0501), and gateway-descriptor.json was written at 19:51.
  • Two product gaps: ConnectError.Internal does not say the TLS certificate is not publicly trusted, and the retry loop does not cap or close sockets.

Does this stop you from using Cursor

No - Cursor works, but with this issue

6

Hey @Gurkirat_Singh, thanks for the detailed report, and for sharing the workaround.

You’re right about the cause. Grok Bot currently checks server certificates against its own built-in list of public certificate authorities rather than the Windows certificate store, so when Kaspersky replaces the certificate for its encrypted-connection scanning, Grok Bot rejects the connection. The browser, curl, and Cursor all use the Windows store, which is why they keep working.

Adding Grok Bot.exe as a trusted application with “Do not scan all traffic” (or turning off encrypted-connection scanning) is the right fix for now, so please keep that exclusion in place.

I’ve passed this to the team, including both points you raised: the error should say the certificate isn’t trusted and name the issuer, and the app shouldn’t keep retrying and opening new connections when this happens.