Exclude Windows Security so Grok Bot local-exec stays up

On Windows, idle Grok Bot can stay connected for hours while CopyFromBox + Shell + Chrome UI work makes the app window vanish and ListMachines flip to disconnected — often with no crash dump. Staff (mohitjain, Sep 22, 2026) on forum 172549: endpoint security is ending the Grok Bot process (no tray on Windows, so ending the process closes the app and drops the connected computer).

Staff unblock (admin)

From an admin account in Windows Security:

1. Add a process exclusion for Grok Bot.exe (install under %LOCALAPPDATA%\Programs\Grok Bot\ on the usual setup).
2. Add a temporary folder exclusion for your Temp path (%LOCALAPPDATA%\Temp / the user Temp the agent writes into).
3. Re-run the same CopyFromBox + Shell / Chrome automation once.

If the session stays up, Windows Security was ending the process under load.

If it still dies

Staff asked for two checks in the same minute the window vanishes:

1. Task Manager → Details — is Grok Bot.exe still running? (quit vs lost window)
2. Windows Security → Virus & threat protection → Protection history — any entry naming a script or Grok Bot

Reply on the forum thread with those two results so staff can continue.

Related AV classes

• F-Secure DeepGuard / Temp: When F-Secure blocks Grok Bot local-exec on Windows.
• Kaspersky HTTPS scanning: When Kaspersky blocks Windows Agent Computer.

Pitfalls

• Excluding all of Temp is a security tradeoff. Prefer confirming the class, then narrowing with your security team once staff publish a tighter allowlist.
• Non-admin shells often cannot add Defender exclusions — use an elevated admin account.
• Reinstall alone did not fix the report on 172549 when endpoint security kept killing the process under automation.