When Windows in-app update fails Authenticode

The Grok Bot desktop app on Windows can download an update and then refuse to install it. The UI may say the downloaded update could not be verified (Korean builds: “다운로드한 업데이트를 확인할 수 없어 설치되지 않았어요”). FileVersion stays on the old build (reports show 0.36 stuck while 0.39 is current, or 0.44 stuck while 0.47 is current). %LOCALAPPDATA%\sand-updater\installer.exe stays the old binary. Thread: forum 171265.

This is the Windows desktop app updater, separate from Update / Recover / Reset Grok Bot’s Computer on the Agent Computer (When client Update, Recover, or Reset fails).

What the updater checks

The app runs Get-AuthenticodeSignature on the downloaded installer through PowerShell. It expects status Valid and signer Anysphere, Inc. Failure kind is installer_signature_invalid (UI id VZlSAx). On fail, the app deletes the downloaded file, so the sand-updater path never advances.

No staff reply on the thread yet. The known path that works is the official installer from the download page.

Update with the official Setup.exe

1. Quit Grok Bot completely (tray icon included).
2. Download Setup.exe from cursor.com/download/bot (stable win32-x64 builds also live under downloads.cursor.com/grokbot/stable/win32-x64/…).
3. Confirm Authenticode before you install. In PowerShell:

Get-AuthenticodeSignature .\Setup.exe | Format-List Status, StatusMessage, SignerCertificate

Expect Status: Valid and a signer that names Anysphere, Inc. 4. Run a silent install:

.\Setup.exe /S

5. Reopen Grok Bot and check About / FileVersion against the build you just installed.

If Authenticode is not Valid on the official file

Stop. Do not run an unsigned or third-party copy. Re-download from the official page on a clean network path, re-check signature, and only then install. Reply on the forum with the Get-AuthenticodeSignature Status line and app version if Valid still fails after a fresh download.

Related

• Linux package install: Install Grok Bot on Linux
• Windows launch crash after install: Fix Windows Grok Bot instant launch crash

Pitfalls

• Treating this as Agent Computer Update/Recover/Reset — those buttons do not replace the desktop app binary.
• Leaving sand-updater’s old installer.exe as the source of truth after a verify fail; the app deleted the bad download on purpose.
• Skipping the Authenticode check on Setup.exe before /S.