METAGROK
GROK BOT / fix-api2-100-x-wrong-certificate-without-reset

Grok Bot

Fix api2 100.x wrong certificate without Resetting Grok Bot

fix-api2-100-x-wrong-certificate-without-reset

If Grok Bot keeps reconnecting, api2.cursor.sh resolves to a 100.x address, and TLS shows a certificate for an unrelated host such as devapi.english.com, the agent computer is usually healthy. Cursor staff (mohitjain, thread 172578) told the reporter not to Reset or Recover.

What the failure looks like

  • Reconnect loops while on the office or school network.
  • api2.cursor.sh resolves to an address in 100.0.0.0/8 (example from the thread: 100.60.17.13).
  • That address presents a wrong TLS certificate (Pearson / devapi.english.com in the report).
  • A phone hotspot connects normally on the same laptop.

Staff confirmed 100.60.17.13 is a real api2 address and serves the correct api2.cursor.sh certificate from outside that network. The wrong cert means the local network is delivering that address to the wrong server.

Do this first

  1. Skip Reset and Recover. They wipe or roll back the computer and will not fix a routing or TLS interception problem on your LAN.
  2. Switch to a phone hotspot (or another clean network) so you can keep working.
  3. From the failing office network, compare routes:
traceroute -n 100.60.17.13
traceroute -n 34.235.15.195

If the paths diverge, the office firewall, NAT, or ISP is redirecting part of 100.0.0.0/8. That range is often confused with carrier-grade NAT (100.64.0.0/10) and gets a mistaken firewall or NAT rule.

  1. Ask the network team to review firewall, NAT, and routing rules that cover 100.0.0.0/8, then retest api2.cursor.sh TLS on the office network.

Checks that waste time here

  • Reset / Recover / Update Agent Computer as the first move
  • Reinstalling the app while the hotspot already works
  • Treating a 100.x api2 address as “private junk” without comparing certificates from a clean network

Pitfalls

  • A healthy computer plus a poisoned 100.x route still shows reconnect errors. The message covers network path problems.
  • Hotspot success is evidence, not a permanent workaround — fix the 100.0.0.0/8 rule so the office path serves the real api2 certificate again.
  • Corporate SSL inspection can produce similar wrong-cert symptoms on other hosts; see Fix Zscaler SSL blocking the Grok Bot computer.

Related