Grok Bot is an AI agent from SpaceXAI (the company formerly known as xAI) that works from its own cloud computer. It signs in to your apps, uses them the way you would, and comes back with finished work. It launched in beta on August 11, 2026. It isn't sold on its own. Since October 12, 2026, it's part of the Premium, Super and Ultra tiers of The X Subscription, and older Cursor and SuperGrok plans still include it.
That's the announcement. This article covers the rest. You'll see what Grok Bot actually does, which plans include it and whether you can try it for free. You'll also see what its own documentation says about the risks of handing an agent the keys to your inbox.
How we verified this. We first reviewed Grok Bot's public documentation, pricing, terms and launch video in August 2026. For this update, on October 19 and October 29, 2026, we checked the official product page (x.ai/bot) and The X Subscription announcement and pricing docs. We also checked the Grok Bot documentation at docs.x.ai, Cursor's Grok Bot billing help page and SpaceXAI's terms of service. We haven't tested the product ourselves, so where we describe behavior, we describe what the vendor states. Plans and prices at these companies change often, so check before you buy.
What exactly is Grok Bot?
Think of a coworker who has their own laptop and logins. You message them a task, they go do it, and they tell you when it's done. Grok Bot is the AI version of that. The technical name for this kind of tool is a computer use agent.
The difference from a chatbot is that it doesn't just answer you. It acts. You assign a task, and it opens a browser, gets into your tools, fills in forms, drafts emails and reports back.
Each user gets one persistent cloud computer with a browser, files and a terminal. That's where your Bots live and work, not on your own machine. Closing your laptop or phone doesn't stop them, according to the official FAQ.
You talk to Grok Bot through apps, not a website. The docs list desktop apps for macOS (Apple silicon and Intel), Windows (x64 and Arm64) and Linux (x64 and Arm64). There are companion apps for iPhone (iOS 18 or later) and Android (9 or later). The iOS app also runs on iPad with iPadOS 18 or later. Your Bots and conversations sync across all of them.
Here's a fact a lot of coverage skips: Grok Bot runs on Cursor's accounts and infrastructure. The docs say it plainly: "Grok Bot uses Cursor authentication and account data settings." Cursor's help center hosts the Grok Bot billing pages, and legacy Cursor plans include it.
The names: Grok Bot, xAI, SpaceXAI
You'll see several names, so it's worth untangling. The company behind Grok was called xAI. Its site footer now reads "© 2026 SpaceXAI LLC," while its page titles and current terms of service use the name "SpaceXSI." We use SpaceXAI here. Grok is the chatbot. Grok Bot is the agent.
What is a computer use agent?
A computer use agent is an AI system that operates a computer the way a person does. It looks at the screen and uses the mouse and keyboard. Most software connects to other services through APIs (application programming interfaces), which are official doors built for programs.
Connecting through an API is clean: defined permissions, limited actions, a record of what happened. But it only works if the service has an API and the vendor has built a connection to it. Driving the computer like a person needs none of that. If you can do it in a browser, so can the agent. That includes an old company CRM, an intranet with no API or a government portal.
The price of that flexibility is that the agent works with your full access. It doesn't get "permission to read email." It gets your email session, all of it.
Grok Bot uses both paths: connectors for supported services, and computer use for everything else. The docs recommend a connector whenever one exists, because it's more structured and reliable.
Thinking about building agents like this yourself, rather than just renting one? See how the main training routes stack up in our side by side program comparison.
How does it sign in to your tools?
The product page promises Bots that "sign in to your tools, use them just like you do, and come back with finished work." The docs describe how that works, and it has changed since launch.
Connected apps. For supported services, you authorize the Bot through a standard sign in flow, the same kind you use when you let one app access another. The app can only do what that account is allowed to do.
Saved logins, in a fixed order. When a website asks for a login, the Bot first uses one you saved in its Vault. If there isn't one, it tries a connected password manager such as 1Password. If that fails too, it asks you to type the value into a Secure Form. The docs say those values are filled into the page by reference, so the model never sees the password.
Sessions that stay. Once the Bot is signed in, the browser session persists on its cloud computer. That's what makes the marketing claim true, and it's where most of the risk sits.
The weakest point, and the vendor says so
This is the fact to understand before any other. The official documentation says:
"All of your Bots share one cloud computer assigned to your user account. Files, browser sessions, and command line credentials on that computer are available across your Bot roster."
And right after it:
"Do not use separate Bots as a security boundary."
In practice, there's no isolation between your Bots. If you sign in to your CRM for a sales Bot, a research Bot that reads outside email and browses unknown sites has that same session. The product page puts it in one line: "Isolation is per user, not per Grok Bot." Each Bot gets its own screen on the shared computer, but that's a workspace, not a wall.
What about two factor codes?
Often the Bot handles them itself now. When a site emails a one time code, the docs say the Bot can read it from a connected Gmail or Outlook account or from its own inbox.
It hands the computer back to you only for steps a form can't do: single sign on, a passkey, a CAPTCHA it couldn't get past, an approval on another device or a QR code, a bank card verification, or a site that requires a human. You finish that one step and tell it to continue.
There's one shortcut. If you use a hardware security key like a YubiKey, the Bot's browser can use the key plugged into your desktop. The docs say that setting is on by default on macOS and Windows, isn't supported on Linux yet, and asks for your approval every time.
Does it ask permission before acting?
There's an approval system, but it isn't a fixed list of rules.
Asked which actions need approval, the official FAQ says it "depends on the tool, the risk of the action, and, when enforcement is enabled, your Auto-review rules." It suggests writing standing limits into each Bot's description and adding Ask first rules for things like sending, publishing, deleting, buying or changing production systems.
What decides in the gray areas? A classifier, which is an AI model that judges each action. Cursor's documentation for the same Auto-review feature is direct about its limits: "Auto-review is not a security boundary," and "The classifier can make mistakes."
One line in Grok Bot's docs is worth reading twice:
"An approval controls the proposed action. It does not reverse work already completed."
Approval governs what's about to happen. What already happened stays done.
Prompt injection: now in the docs
In our August review, we couldn't find prompt injection mentioned in Grok Bot's public docs. That has changed. Prompt injection is when a web page, email or file hides instructions that try to steer the agent, and it's the risk of this category.
The current security page has a section on it. It says outside content is marked as untrusted when the model sees it, and that Auto-review, network rules, approvals and per user isolation sit behind that. It also says these controls "reduce, but do not eliminate" the risk.
That's an honest statement, and it lines up with outside advice. Anthropic's computer use documentation recommends "avoiding giving the model access to sensitive data, such as account login information," and warns that "using computer use within applications that require login increases the risk of bad outcomes as a result of prompt injection." Signing in to apps is exactly what Grok Bot is built to do.
What does Grok Bot cost?
Grok Bot isn't sold on its own. It comes with a plan you may already have. The big change came on October 12, 2026, when SpaceXAI launched The X Subscription, one plan that bundles Grok, Grok Bot, Cursor and X Premium.
Here are the plans that include Grok Bot, per x.ai/pricing and The X Subscription pricing docs, checked October 19, 2026:
| Plan on The X Subscription | Monthly price | Includes Grok Bot? |
|---|---|---|
| Free | $0 | No |
| Plus | $8 | No |
| Premium | $30 | Yes |
| Super | $100 | Yes, more usage than Premium |
| Ultra | $200 | Yes, the most usage |
| Teams | Premium, Super or Ultra seats at the same per seat prices | Yes |
| Enterprise | Custom | Contact sales |
The docs also list annual prices. Prices don't include taxes.
Already on an older plan? Switching is optional. Cursor's help center says Grok Bot is still included on legacy Cursor Pro, Pro+, Ultra and self serve Cursor Teams plans. You can also link an individual SuperGrok, SuperGrok Plus, SuperGrok Heavy or X Premium+ subscription to a Cursor account to get Grok Bot usage. A Cursor plan and a linked subscription don't add together. Grok Bot uses whichever one gives more weekly usage. The Plus tier on The X Subscription and SuperGrok Lite don't include it.
Enterprise. Grok Bot is available on Cursor Enterprise. Per the docs FAQ, an admin enables it for the team, and you contact your Cursor account team to set it up. The official product page (x.ai/bot) also lists Grok Bot as generally available for Enterprise, with sales setting up access. It's a sales conversation, not a checkout button.
Is Grok Bot free?
There's no permanent free tier. Some accounts get a free trial: the docs say to choose Start Trial when the access screen offers it. Cursor's help center describes it as a usage credit rather than a set number of days, with a 7 day window that also applies. The credit is used up by how much work your agents do, measured in agent steps and tokens, not messages.
A few details worth knowing before you start one:
- A single large task can use most or all of the credit at once, and used credit isn't restored.
- The trial never turns into a paid plan, and there's no charge to cancel it.
- On a free plan you can end the trial early with Cancel Trial. That removes any remaining credit, and you can't start the trial again. On a paid plan or Teams seat, the trial simply ends on its own.
Watch the usage meter
Every plan comes with weekly usage. On The X Subscription, Grok Bot draws from the same weekly pool as Grok and Cursor. When the pool runs out, extra usage is paid from prepaid credit that you top up. On legacy Cursor plans, extra usage can continue as on demand usage billed by token cost.
You can set a monthly limit on that extra usage. But Cursor's help center notes the limit isn't a hard stop in the middle of a run: a Bot that's already working can finish past it. Agents that keep running in the background use a lot of tokens, the small chunks of text AI usage is measured in. Check your usage page from day one.
Which model does it run on?
You can't choose. The docs say Grok Bot picks the model for each task, and there's no model picker. Each request goes to a first party SpaceXSI model or a third party model from a provider on its sub processor list, and the choice can change from one request to the next. Grok Bot doesn't show which model handled a request: usage views record it all as Grok Bot usage. If your company restricts which vendors can process its data, the docs point you to your account team.
The fine print: what you're agreeing to
This is the part that shows up least in the coverage and matters most to you.
Who's responsible for what the Bot does
SpaceXAI's terms of service were last updated October 12, 2026. They define "Agentic Actions" as the things Grok does on your behalf. That includes browsing, running code, sending messages, changing files and dealing with third party services, including financial institutions. Then they put responsibility on you:
"We are not responsible for User Content or Agentic Actions. You are responsible for User Content and Agentic Actions, including ensuring that it does not violate any applicable law or these Terms and any consequences, costs, or liabilities arising therefrom."
The terms also note that some countries don't allow certain disclaimers, so some of them may not apply to you. Consumer protection law varies by country, and this article isn't legal advice.
The tools it works in have rules too
Many websites and apps restrict automated access or sharing your login with someone else in their own terms. None of that means using Grok Bot breaks a given platform's rules. We know of no ruling on it. It means you take on the risk that a platform sees an agent's activity as unauthorized automation. The usual result is a suspended account. Check with your legal team before you connect Grok Bot to work accounts.
Banking: the line we wouldn't cross
Banking rules in most places expect you to protect your login details. No regulator or court we know of has said whether handing a banking session to a cloud AI agent counts as careless.
Our advice is simple: don't sign in to online banking from the Bot's computer. Every Bot on your account shares that machine and its sessions. The same caution goes for cards: the docs say a card saved in Vault fills in at checkout without a separate approval each time, so if you want to approve every payment, don't save the card. Your bank's own terms are usually stricter than the law, so read them too.
Audit logs: Enterprise only
This has changed since launch. The security docs now describe three features, all Enterprise only:
- Audit logs for admin, security and sign in events, plus Grok Bot events like creating Bots, access changes and routines.
- Action Recording, off by default, which records what Bots do, including cleaned up shell commands, and keeps it for 90 days.
- Export of those events, and optionally conversation content, to your own logging tools.
Self serve Teams plans don't get the audit log. If you're on one, the record of what a Bot did has to come from the tools it worked in.
One more limit: Grok Bot needs cloud data storage, so it doesn't work with Cursor's Legacy Privacy Mode, the strictest setting.
Enterprise network controls are documented now
In August, the product page said enterprise admins could set data loss prevention (DLP), certificates, proxies and network controls. We couldn't find those in the public admin guide then. The docs now include pages on private networks and TLS inspecting proxies, which link to Cursor's network configuration guide for SSL inspection and DLP requirements. If those matter to you, read those pages with your IT team.
What does the launch video actually show?
When Grok Bot launched in August, we went through the full launch video frame by frame. It runs 106 seconds, has 69 cuts, and its longest unbroken shot is 4.7 seconds. That's not enough to show a task from start to finish.
It isn't a product demo. It's a testimonial ad: people talking to the camera, with shots of screens in between. Zoomed in, some conversation titles read "EXAMPLE / DEMO DATA," so at least part of what you see is test data. Nothing on screen shows how long a task takes.
In the one moment where signing in is visible, around second 14, the person signs in, not the Bot. They click "Log in with Okta SSO," complete two factor and hand control back. That matches the docs. It just sharpens the tagline: with SSO and two factor, "they sign in to your tools" means you open the session.
How does it compare to other agents that work for you?
Agents that do tasks for you differ mainly in where they run and whose logins they use. Before you compare products, ask three questions:
- Where does the agent work? On a cloud computer that keeps running when your laptop is closed, like Grok Bot, or on your own machine with an app open.
- Does it sign in to your accounts? Grok Bot does, with saved logins and sessions that stay on its computer. Some agents only browse public pages.
- Who else shares that computer? With Grok Bot, every Bot on your account shares one machine and its sessions.
Vendors change these details often, so check each product's own documentation on the day you decide. Our comparison of AI coding agents covers the coding side and is kept up to date.
Four practical rules if you try it
- Never connect banking or other high stakes logins. All your Bots share one computer and its sessions.
- Treat the approval classifier as a helper, not a wall. The docs say so.
- Set a usage limit and watch it from day one. A running task can finish past the limit.
- Read the Agentic Actions clause before you hand over keys. Under the current terms, responsibility sits with you.
What this means if you want to build agents
Two takeaways matter more than the product itself.
First, this doesn't replace learning. It changes what's worth learning. Clicking through apps is the easy part now. The hard part is everything around it. What access do you grant? How do you check what the agent did, and what happens when it's wrong? Notice that almost every serious question about Grok Bot is about design and oversight, not intelligence. That's where the work is.
Second, reading technical documentation carefully is a real advantage. Almost everything in this article came from comparing the docs with the marketing. No secret sources. That's a skill you can practice.
If you want to be on the side that designs these systems, that's what 4Geeks Academy's AI Engineering program works on. If you're choosing a tool for your own work, our comparison of AI coding agents is kept up to date.
Go deeper on Grok Bot
- Grok Bot news and updates: what's changed since the August 2026 launch.
- How to set up Grok Bot: a step by step setup walkthrough.
- 10 real Grok Bot use cases: workflows people have actually replicated.
- Grok Bot Team Bots: how a whole team shares one Bot, with private chats and shared team memory.