METAGROK
GROK BOT / when-kaspersky-blocks-windows-agent-computer

When Kaspersky blocks Grok Bot on Windows

when-kaspersky-blocks-windows-agent-computer

Windows Grok Bot can fail Update, Recover, and Agent Computer connect while Android on the same account stays healthy. Network Debugger shows many failed checks. On forum 171186, two reporters (glittle, RoamPT) restored Windows by pausing Kaspersky protection. Versions seen: 0.44.0 and 0.47.0.

Staff (mohitjain) also diagnosed a separate dual Agent Computer failure on the same thread. Use this page when Android is fine and pausing Kaspersky restores Windows. Use When a duplicate Agent Computer blocks reach when staff says two copies exist and you must stop Reset/Update/Recover.

Confirm the class

Signal Expected here
Windows Update / Recover / connect Fails; Network Debugger noisy
Android on same account Connects; health checks clean
Pause Kaspersky protection Windows reaches the Agent Computer again
Resume Kaspersky Breaks again

Restore Windows without Reset

  1. Quit Grok Bot completely (tray icon included).
  2. In Kaspersky, pause protection (temporary pause is enough for the test).
  3. Open Grok Bot on Windows and retry connect. Skip Reset/Update/Recover while you are still testing AV.
  4. If Windows connects, keep Kaspersky paused only long enough to finish work, then add a standing allow for Grok Bot / cursorvm traffic in Kaspersky network or application rules (product menus vary by edition).
  5. Re-enable Kaspersky and confirm Windows still connects. If it fails again, leave a product/version note on the forum thread so staff can publish an allowlist.

If pause does nothing

Stay on the dual-copy path: do not hammer Reset. Email hi@cursor.com with your account and that Android works while Windows cannot reach the computer. Generic network steps: Fix Grok Bot “Can’t reach your computer”.

Encrypted connections scanning (cert MITM)

On looping reconnection, staff (deanrie, Sep 11, 2026) saw Kaspersky Encrypted connections scanning replace the HTTPS certificate. Cursor, the browser, and curl.exe accepted Kaspersky’s root; the Grok Bot app rejected it. Phone still worked. Kaspersky showed no block log. Reinstall and hotspot tests failed because the MITM lives on the PC.

Confirm:

  1. In Edge or Chrome open https://api2.cursor.sh, open the lock → certificate details.
  2. Issued by should be something like Amazon RSA 2048 M01. If it says Kaspersky Anti-Virus Personal Root Certificate (or another AV root), you have this class.

Fix (menus vary by Kaspersky edition):

  1. Quit Grok Bot from the tray; end leftover processes in Task Manager.
  2. Kaspersky → Settings → Security settings → Network settings → Encrypted connections scanning → Do not scan encrypted connections, or Threats and Exclusions → trusted applications → add Grok Bot with Do not scan encrypted traffic.
  3. Open Grok Bot and wait about two minutes.

Do not Reset, Recover, or Update Agent Computer for this pattern — the cloud computer is healthy.

Pitfalls

  • Resetting while Kaspersky still blocks the gateway — you can land in partial state for no gain.
  • Treating every 171186 reply as dual-copy when Android is healthy and an AV pause restores Windows.
  • Leaving protection off permanently instead of a product allow rule.
  • Chasing Reset while Issued by still shows a Kaspersky root on api2.cursor.sh.