Grok Bot Security 2026: What the Docs Actually Say

Grok Bot security rests on one fact the launch marketing does not lead with: every Bot on your account shares a single cloud computer, including its files, browser sessions and logins. SpaceXAI's documentation says so plainly, and adds a warning — "Do not use separate Bots as a security boundary."

TL;DR

SpaceXAI — the division of SpaceX formerly known as xAI¹ — launched Grok Bot on 11 August 2026 as an early beta: a team of always-on agents that sign into your tools and work inside them.² The launch post says Bots "have their own computer." The documentation published the same day says something narrower and more important — every Bot on your account uses one persistent cloud computer, and SpaceXAI explicitly tells you not to treat separate Bots as a security boundary.³ The docs also disclose three gaps the launch post does not: there is no audit view of Bot actions yet, no Grok Bot spend cap yet, and no model picker — not now and, per SpaceXAI, not planned.⁴ This post reads the documentation instead of the press release.

What you'll learn

• Why the shared-computer design is the central Grok Bot security fact
• Where the launch post, the press coverage and the documentation disagree
• How the credential model works when one sign-in serves every Bot you own
• What an approval actually controls, in SpaceXAI's own words
• Why there is no Grok Bot audit log yet, and what exists instead
• Why the Grok Bot model picker is not coming
• What Grok Bot pricing is published, and which number is not
• Which platforms are supported, and why "Linux" keeps appearing incorrectly
• What the launch testimonials reveal about the intended supervision model
• A rollout checklist drawn from SpaceXAI's own recommendations

Do Grok Bots share one computer? Yes — and that is the whole story

Yes. SpaceXAI's FAQ answers this directly: "Every Bot on your account uses one persistent cloud computer. They share its files, browser sessions, and logins so they can hand work off. […] The computer is assigned per user, not per Bot. Do not use separate Bots as a security boundary."³

The Grok Bot shared computer is a managed Linux virtual machine dedicated to one member, on which the Bot runs as a non-root user.⁴ What is per-Bot is the screen: "Each Bot gets its own screen on the shared computer," and one Bot can run one computer-use task on its screen at a time. The documentation is careful about what that separation is worth — "The screens are separate work surfaces, not separate security boundaries."⁵

The practical consequence is spelled out in the same page. Browser cookies and signed-in sessions are shared. Files are visible to every Bot. Command-line credentials are shared. One Bot can continue from work another Bot saved.⁵ So the intuitive mitigation — give the risky job to a Bot with a narrow remit, keep finance in a different Bot — does not do what it looks like it does. Every Bot you own inherits every session you have ever established on that machine.

Deletion follows the same rule. "Deleting a Bot does not remove shared-computer files or browser sessions."⁶ Removing the Bot removes its profile, conversation and routines; the FAQ's phrasing is that "files and logins on that computer may remain" for its colleagues.³

Where the launch post, the coverage and the documentation disagree

Three surfaces went live on 11 August 2026 and they do not say the same thing. This matters because most readers will only ever see the first one.

To be fair to the launch post, a later section of it is more precise than its opening: "Bots share a computer of their own in the cloud, so jobs do not stall when you step away."² That sentence is accurate. It sits several paragraphs below the flat claim that "Bots have their own computer," on a page whose meta description repeats the flat version — and the compressed version is what travelled.

The documentation is not hidden and it is not late — both the FAQ and the approvals page carry "Last updated: August 11, 2026," the launch date.³⁶ SpaceXAI published the more careful version on day one. It is the version worth reading before a rollout.

AI agent credentials: one sign-in, every Bot

The product's pitch is that Bots "can sign in to your tools, use them just like you do, and come back with finished work."⁷ The product page's own illustration is a user typing "Sign in to Zendesk so I can work the support queue."

That design choice is what makes Grok Bot useful on software that was never instrumented for agents — the company explicitly covers websites and applications with "no clean API or MCP."² It is also the choice that runs against the direction agent identity work has taken this year. The pattern the standards side has been converging on is the opposite: give the agent its own scoped, revocable identity rather than a seat inside yours. That is the premise behind Web Bot Auth's cryptographic agent verification, and behind the non-human identity consolidation that produced Cyera's acquisition of Oasis Security. 1Password has shipped a third route, in early access: the agent asks for a specific site login, an approval prompt appears in the user's 1Password desktop app, and only the minimum credential data is injected into the agent's browser, so the agent never handles the password itself.⁸⁹ Its own documentation promises detailed audit logs showing when, where and why an agent used an item as a future feature — so the alternative route currently has the same reconstruction gap.⁹

Grok Bot does carve out the most sensitive steps. The Bot is supposed to hand you control of the computer for a password or passkey, two-factor authentication, a CAPTCHA, a payment or identity check, or a site that explicitly requires a human.⁵ For a supported connection presenting a secure secret request, the value "is masked, excluded from the transcript, and not shown to the model" — though the docs are careful to add that this "is not a general-purpose password manager."⁶ Hosted MCP server tokens are held by Cursor's backend rather than on the computer itself.⁴

What is not carved out is the resulting session. "Because the browser is shared, signing in for one Bot makes the session available to your other Bots."⁵ Installed connectors are account-wide, and their availability "is not isolated to one Bot."⁵ The password never reaches the model; the logged-in session reaches every agent you run.

Two enterprise details compound this. The computer is "not by default enrolled in mobile device management," and device-trust agents such as Okta FastPass "are not available for it natively."⁴ Hardware keys do work — WebAuthn prompts in the computer's browser are forwarded to the desktop app and the physical key — but Windows support for that forwarding is described as in progress.⁴ Traffic leaves through static egress IP addresses; separately, the same page notes that some services flag datacenter IP addresses and block the Bot.⁴

What a Grok Bot approval actually controls

One sentence in the approvals documentation does more work than anything in the launch post: "An approval controls the proposed action. It does not reverse work already completed."⁶

Approvals are a gate on the next step, not an undo. The docs recommend setting explicit boundaries in the request itself for sending messages or invitations, publishing content, purchases and financial transfers, deleting or overwriting data, changing permissions, production changes, and accepting legal terms.⁶

Above that sits Auto Review. "When Auto Review enforcement is available," SpaceXAI says, Grok Bot "evaluates tool calls and computer actions before they run"⁶ — the conditional is the vendor's, not mine, and the FAQ carries its own version, referring to what happens "when enforcement is enabled."³ Require Approval rules always stop a matching action; Always Allow rules let one proceed only if the automated review finds no other reason to stop; when both match, Require Approval wins.⁶ SpaceXAI's own caveat is the part worth quoting: "Auto Review is model-based and should complement, not replace, least privilege and explicit approval boundaries."⁶ A model is checking the model.

There is also a synchronisation trap. "Personal Auto-review rules are stored on the current desktop and synced to its Grok Bot computer. Verify them separately on another desktop installation."⁶ Rules you set on your laptop are not guaranteed to be the rules in force from your desktop.

For your own machine, execution on the local computer defaults to "Ask every time," with Always allowed and Never allowed as the alternatives; the documentation recommends Never allowed unless a Bot has a specific reason to touch local files.⁶ A team-level ceiling on local execution — Never, Ask every time, Always, with members able to choose stricter but not looser — is listed as coming soon, which means it is not available today.⁴

Grok Bot audit log: there isn't one yet

There is no audit log at launch. The enterprise documentation is unambiguous: "Spend and usage appear on the dashboard usage page. An audit view of Bot actions is coming." The same page's FAQ repeats it under "Can I see what Bots did on behalf of my team?"⁴

The layer underneath does not fill the gap either. Cursor — whose account system Grok Bot runs on — does offer audit logs, but only on the Enterprise plan, and they cover administrative and security events: logins, user management, API keys, team settings, privacy-mode changes. That page states plainly, "We do not log agent responses or generated code content," and points customers at hooks if they need development activity recorded.¹⁰ Cursor does offer Enterprise customers a separate beta pipeline that streams usage telemetry over OpenTelemetry, but its documented signals are metrics and event logs, and the page is explicit about the limits: "No prompt content, no traces, and no historical backfill." The surfaces its logs identify are Cursor's own IDE, CLI and cloud agents; the page does not mention Grok Bot either way.¹¹ Neither surface answers the question you would actually ask after an incident: what did the agent do inside someone else's system. Organization admins can inspect and remove member computers — the Kill action deletes the running virtual machine while durable storage is kept, and the member's next session creates a fresh one — but that is containment, not reconstruction.⁴ Team admin rights are not sufficient for this, because a computer is shared across every team the member belongs to.⁴

This is the gap that matters most for anyone deploying against production systems. An agent that signs in as you, works unattended, and hands work to other agents on the same machine is precisely the case where attribution is hard, and attribution is the thing that is still shipping.

Grok Bot model picker: not now, and not planned

Most products that hide the model say the picker is coming. SpaceXAI says the opposite: "Grok Bot has no model picker, for members or admins. We do not plan to allow admin or user choice for models that are used with Grok Bot. Model choice is fully managed by the product."⁴

Each request routes to a fixed set of models for its surface with automatic failover. Usage analytics show which model actually served each request, including failovers, and billing follows the actual serving model.⁴ Organisations with contractual limits on subprocessors are told to contact their account team before rolling out.⁴

Matt Shumer, who wrote on X that he had been testing Grok Bot for a couple of weeks before launch, made the same observation from the outside — "You don't choose a model for your Grok Bot" — and said the router "wasn't great" during his testing, adding that he was later told it had improved. VentureBeat quoted those posts in its launch coverage.¹ SpaceXAI has not published benchmarks for Grok Bot's performance on agentic tasks.¹

Grok Bot pricing: what is published, and what isn't

Grok Bot is not sold standalone. It rides on subscriptions that already existed.

⚠ Prices change frequently. The values above are for illustration only and may be out of date. Always verify current pricing directly with the provider before making cost decisions: Anthropic · OpenAI · Google Gemini · Google Vertex AI · AWS Bedrock · Azure OpenAI · Mistral · Cohere · Together AI · DeepSeek · Groq · Fireworks AI · Perplexity · xAI · Cursor · GitHub Copilot · Windsurf.

That third row is worth dwelling on. VentureBeat states SuperGrok Heavy's price as a settled fact — "$300 per month" — in the middle of its launch coverage.¹ SpaceXAI's own pricing page, checked on 14 August 2026, shows priced cards for Free at $0, SuperGrok at $30 per month and SuperGrok Plus at $100 per month; SuperGrok Heavy appears only as a column in the feature-comparison table, with a "Get Heavy" link and no price attached.¹² The $300 figure is likely right — it is simply not something SpaceXAI publishes on the page everyone links to, which is worth knowing before you quote it in a budget.

A smaller naming wrinkle in the same area: the launch post calls the team plan "Cursor Teams Premium" while the product page's pricing card calls it "Cursor Premium Teams."²⁷ The docs use the former.³ They are the same plan.

Access by plan, per the documentation: individuals via SuperGrok Heavy, Cursor Ultra, or a one-time trial; self-serve teams available, with Premium seats including a weekly Grok Bot usage allowance and Standard seats using the free trial or on-demand usage; enterprise organisations rolling out, via the Cursor account team.⁴ Subscriptions include weekly usage, and eligible accounts can add on-demand usage billed from model and token cost.³

And, as with the audit log: "There is no Grok Bot-specific spend cap yet."⁴ Account-level on-demand controls still apply and per-product spend appears on the dashboard, but an always-on agent with no product-level ceiling is the exact configuration that made session-level spend caps a live topic across the agent tooling market this month.

Which platforms Grok Bot supports

The documentation lists three: macOS on Apple silicon and Intel, Windows on x64 and Arm64, and iPhone on iOS 18 or later. It then states what is excluded: "Linux desktop, Android, and iPad are not supported at initial launch."³

Linux keeps surfacing incorrectly in coverage because both things are true at once — the agent's cloud computer is a Linux virtual machine, but there is no Linux desktop client. SpaceXAI answers it as its own FAQ entry: "Is there a Linux desktop app? No. Computers run Linux, but the desktop app ships for macOS and Windows, plus the mobile apps."⁴ VentureBeat lists Linux among the launch platforms; Unite.AI reported that "a Linux build is posted."¹¹³ The download offered on the product page at the time of writing is Grok_Bot_0.18.0.dmg for Apple silicon, served from Cursor's download infrastructure.⁷

The testimonials describe the supervision model

Vendor launch quotes are marketing, but they are also a statement of the behaviour a company considers a success. Two of the five in the Grok Bot announcement describe supervision being withdrawn.

Bennett, in sales: "I showed Grok Bot a workflow once and now I just fully trust it to run forever. I feel like I'm 2-3x more efficient because it does it without me verifying and reviewing."²

Emma, in operations: "When I first started, I was checking in on them every 15 minutes and micromanaging the Bots to the point where they asked me why I kept asking so many questions. […] Now I let it do its thing and it's just gotten better with time."²

Read next to the approvals page, these sit awkwardly. The documentation tells you to keep sending, publishing, purchasing, deletion and production changes behind approval, to start with read-only tasks and draft outputs, and to review installed connectors and active routines regularly.⁶ The launch post celebrates an employee who stopped verifying and reviewing. Both were published by the same company on the same day, and only one of them is load-bearing when something goes wrong.

The teach-a-task feature has its own constraint that shapes how much of a job an agent can absorb this way: the browser workflow recording is limited to ten minutes, the rollout is described as gradual, and the result is a draft skill you are expected to review and test.³ The docs also draw a distinction worth keeping — a skill describes how to perform a task, a routine assigns a workflow to one Bot and tells it when to run, on a schedule or, where supported, after an event. The advice attached to it is blunt: "Test the skill on a real one-time task before turning it into a routine."³

A rollout checklist, drawn from SpaceXAI's own docs

If you are evaluating this for a team, the vendor's own guidance is the strongest available starting point.

• Treat the account, not the Bot, as the blast radius. Sign-ins, files and local-computer permissions belong to the member.⁴ Do not architect around per-Bot isolation that the docs say does not exist.³
• Check Privacy Mode first. Privacy Mode (Legacy) blocks Grok Bot entirely; Grok Bot requires cloud data storage.³⁴ Training opt-out follows the applicable Cursor account and privacy settings.³
• Set local execution to Never allowed unless a Bot has a specific reason to work on local files, and remember the team-level ceiling is not shipped yet.⁶⁴
• Write narrow Auto-review rules around a known action and scope, not broad ones such as "allow everything in the browser."⁶
• Plan for egress. Computers use static egress IP addresses; if you restrict services by source IP, get the current ranges from the account team.⁴
• Inherit your MCP policy deliberately. Grok Bot follows your existing Cursor plugin and MCP policy — there are no separate Grok Bot plugin controls, and MCP authentication is shared across Cursor and Grok Bot.⁴
• Assume no reconstruction. Until the audit view ships, plan incident response around the source systems' own logs rather than the agent platform's.⁴
• Clean up properly. Pause or delete routines, sign out of websites on the shared computer, uninstall connectors and revoke authorization in the source service, and remove sensitive files from /workspace — deleting the Bot does none of this.⁶³

One piece of corporate context, because it determines whose terms apply: Grok Bot uses Cursor authentication and Cursor account data settings, and the desktop build is served from Cursor infrastructure.⁶⁷ SpaceX announced an all-stock agreement to acquire Anysphere, Cursor's parent, for $60 billion on 16 June 2026;¹⁴ reporting on 12 August still described the closing as pending, with regulatory review approaching completion.¹⁵ We covered what the SpaceX–Cursor deal means for developers earlier this year. The practical point for a security review today is that the privacy policy, the SSO configuration and the retention terms you are agreeing to are Cursor's.⁶⁴

Where this leaves the category

Grok Bot is a coherent product with an unusually honest manual. The shared-computer design is a deliberate trade — it is what lets one Bot pick up where another left off, and what makes the whole roster useful on tools with no API. SpaceXAI documents the cost of that trade in the same breath, which is more than most vendors do.

The open question is not whether the agent can operate your software. Anthropic shipped computer use for Claude in public beta on 22 October 2024¹⁶ and has since pushed agentic work at non-developers through Claude Cowork, announced on 12 January 2026 and described by TechCrunch as a more accessible version of Claude Code;¹⁷ OpenAI gave its Codex desktop app background computer use on 16 April 2026¹⁸ and has since shipped ChatGPT Work, which it describes as an agent for "longer, multi-step work and finished deliverables."¹ The capability is settled. The question is what an organisation can prove afterwards. On that, the documentation is clear about where things stand today: no audit view, no product-level spend cap, no model selection, and one set of credentials shared across every agent a person runs. Those are all listed as current state rather than permanent design — except the model picker, which SpaceXAI says is not coming.

Read the docs before the deployment, not after the incident.