Computing Life · Share · YageAug 27, 2026, 08:00 UTC+8

Grok Bot Leak: Why an Agent's System Prompt Must Be Frozen

Grok Bot 泄露：为什么 agent 的 system prompt 必须冻结

The community reverse-engineered Cursor's desktop agent Grok Bot 0.18.0, revealing it freezes the memory and profile sections of the system prompt at compaction boundaries, keeping them byte-identical within an epoch. This preserves KV cache prefix hits: cached input costs $0.30 per million tokens vs. $3.00 uncached, and changing the prefix invalidates the entire cache. Manus's 2025 Context Engineering post independently reached the same conclusion. The codebase also injects runtime status and spills content over 12KB to the filesystem. Manus adds three more disciplines: reciting goals, keeping errors, and injecting structured variation.

Why it matters: Community reverse-engineering of Grok Bot 0.18.0 reveals a frozen system prompt mechanism tied to KV cache cost savings, cross-validated against Manus's 2025 Context Engineering post. Two independent teams converging on the same constraint signals a hardware-forced design, not...

Read the original ↗Export Markdown

Take

This is worth opening because it turns a "best practice" into verifiable code evidence. The community reverse-engineered Cursor's desktop agent Grok Bot 0.18.0 and found it uses `compactionEpoch` to freeze the memory and profile sections of the system prompt, keeping them byte-identical within an epoch. The goal is dead simple: preserve KV cache prefix hits. Anthropic charges $0.30 per million cached input tokens vs. $3.00 uncached, and changing the prefix invalidates the entire cache. Agent runs have roughly a 100:1 input-to-output token ratio, so the cost lives in input—prefix stability directly determines whether the thing is affordable to run.

Manus's July 2025 Context Engineering post independently reached the same causal chain: "Keep your prompt prefix stable." Two teams, a year apart, same solution—this constraint is forced by the underlying economics, not anyone's design taste.

Grok Bot does two more things: injects a runtime `mcp_status` block reflecting this round's MCP failure, and spills tool definitions over 12KB to the filesystem, leaving only a path in context and using `hasReadPath` to verify the model actually read the file. Manus gave the same spillover discipline: the filesystem is the ultimate context, and compression must be restorable.

Manus adds three more mechanisms not visible in Grok Bot's source: reciting goals at the context tail to fight lost-in-the-middle, keeping error traces so the model can adapt, and injecting structured variation. Only Manus's evidence chain exists for these, but the logic holds.

I'd discount slightly: this is reverse-engineered code, not official docs, but code is more honest than blog posts. If you're building an agent harness, these three disciplines—freeze stable prefixes, inject runtime state, spill oversized content to disk—are directly copyable.

Source: Computing Life · Share · Yage · yage.ai
Published: Aug 27, 2026, 08:00 UTC+8 · Aug 27, 2026