Grok Bot is an AI agent from SpaceXAI (formerly xAI, Elon Musk's company) that works from its own cloud computer: it signs in to your applications, uses them the way you would, and comes back with finished work. It was announced on August 11, 2026 in early beta. It isn't sold separately: it comes bundled with Cursor Ultra ($200/mo), SuperGrok Heavy ($300/mo), and Cursor Premium Teams ($120/seat/mo).
That's the announcement. This article is about the other part: what its own technical documentation says about where your passwords end up, what the marketing promises that the docs don't back up, and what exactly you take on when you hand a program the keys to your inbox.
How we verified this. Official announcement dated August 11, 2026. Pricing, technical documentation, and reception data checked between August 11 and 12, 2026 (with pricing and model availability re-verified against official sources on August 20, 2026): we downloaded all 14 pages of Grok Bot's public documentation (1, 889 lines), the official pricing table, xAI's terms of service, and Hacker News and Reddit data via API. We have not been able to test the product: it requires a paid subscription and there is no open trial. Where we describe behavior, we describe what the vendor states, not what we observed. Pricing and availability at these companies change often, so check before you buy.
What exactly is Grok Bot?
It's a computer-use agent. The difference from a chatbot is that it doesn't answer you: it acts. You assign a task, and it opens a browser, gets into your tools, fills in forms, writes emails, and tells you when it's done.
Each user gets one managed Linux virtual machine in the company's cloud, with a browser, a file system, and a terminal. That's where the agent lives and works, not on your machine.
It isn't a web app or an extension. It's a desktop application for macOS (Apple silicon and Intel), Windows (x64 and Arm64), and Linux (x64 and Arm64), plus companion apps for iPhone (iOS 18 or later) and Android (9 or later). Official documentation updated 2 September 2026 lists those platforms and states that iPad is not supported. The mobile apps connect to the same cloud Bots, conversations, routines, connectors, and shared computer as the desktop apps.
And here's the first fact almost no coverage explains: Grok Bot isn't downloaded from xAI: it's downloaded from Cursor. The installer is served from downloads.cursor.com, signup runs through cursor.com/bot/onboarding, the login is "Sign In with Cursor, " and billing shows up in the Cursor dashboard. The documentation states it plainly: "Grok Bot uses Cursor authentication and account data settings."
Which terms actually govern the product is, however, an open question. xAI (X.AI LLC) and Anysphere (Cursor) have separate contracts and privacy policies, with different effective dates, and neither one mentions Grok Bot. Only xAI's governs what it calls "Agentic Actions." We come back to that, because it matters.
The names: Grok Bot, xAI, SpaceXAI, Musk
You'll see all four, so it's worth untangling. Per business press reporting, SpaceX acquired xAI during 2026 and the brand became SpaceXAI; the official site now titles its pages with that suffix while keeping the "© 2026 X.AI LLC" footer. Separately, and also per business press, SpaceX is reported to have agreed to acquire Anysphere, the company behind Cursor, in a deal reported by TheNextWeb and VentureBeat at $60 billion in all-stock consideration, agreed in June 2026. There is still no joint official announcement confirming it as closed, so we treat it as trade-press reporting, not an official fact.
What is verifiable today is the operational fact: Grok Bot is downloaded, authenticated, and billed through Cursor.
What is a computer-use agent?
The concept is worth a stop, because it's the category this belongs to and the one you'll watch grow over the coming months. If that growth has you thinking about building this kind of software yourself rather than just renting it, it helps to see how the main training routes stack up in our side-by-side program comparison.
A computer-use agent is an AI system that operates a computer with mouse and keyboard, looking at the screen, instead of connecting to services through APIs. That's the whole difference, and it explains almost everything else.
Connecting by API is clean: defined permissions, bounded actions, a record of what happened. But it requires the service to have an API, to have it documented, and for the vendor to have integrated it. Driving the computer like a person requires none of that: if you can do it in a browser, so can the agent. It works with your company's ancient CRM, with the intranet that has no API, and with the government portal.
The price of that universality is that the agent inherits your full permissions, with no granularity. It doesn't have "permission to read email." It has your email session, all of it.
Grok Bot combines both paths: API connectors for supported services, and computer use for everything else.
How does it sign in to your tools?
This is the line from the announcement: "they sign in to your tools, use them just like you do, " and it's where everything interesting lives. There isn't one path. There are three, running simultaneously:
1. OAuth connectors. For supported services, the agent connects through the standard authorization flow, the same one you use when granting a third-party app access. Tokens for hosted servers, per the documentation, stay in Cursor's backend and "the computer never stores those tokens." This is the good path.
2. Human sign-in inside the agent's browser. The bot hands you control of the machine, you type the password, and the session cookie persists on that cloud machine. This is the path that makes the announcement's claim true, and the one that brings the problems.
3. Secure secret request. A masked field for secrets belonging to supported connections. The documentation itself warns: "It is not a general-purpose password manager."
The weakest point in the design, acknowledged by the vendor
This is the fact to understand before any other. The official documentation says, verbatim:
"All of your Bots share one cloud computer assigned to your user account. Files, browser sessions, and command line credentials on that computer are available across your Bot roster."
And in case there were any doubt:
"Do not use separate Bots as a security boundary."
In practice: there is no isolation between bots. If you sign in to your CRM for the "sales bot, " the "prospecting bot" (which reads email you don't control and browses sites you've never seen) has that same session open. Constellation Research, independently of the official docs, corroborates the finding: it confirms isolation is "per user, not Grok Bot." Bots get separate screens, but the docs clarify they are "separate work surfaces, not separate security boundaries."
One discrepancy is worth flagging: a user with early access described on Hacker News that each bot runs in its own virtual machine. The official documentation says the opposite. It's a good reminder that early-access testimony is worth checking against the docs, especially on security.
What about two-factor?
It doesn't solve it: it hands it back to you. The default design is a computer takeover: the bot stops and you step into the machine to type the code. The only real automation is forwarding WebAuthn requests from the VM's browser to your desktop app and your physical key, and the documentation notes that Windows support is still in progress.
For teams, the documentation additionally recommends deploying a password manager inside the virtual machine via a setup script, and having members register passkeys. That deserves a second of attention: the recommendation means installing your credential vault on the same machine all your bots share.
Does it actually ask permission before acting?
There is an approval mechanism, but it isn't deterministic and there's no published closed list.
The documentation enumerates categories that should require approval: sending messages or invitations, publishing content, purchases and transfers, deleting or overwriting data, changing permissions, touching production, and accepting legal terms. But the official FAQ, asked which actions require approval, answers that it "depends on the tool, the risk of the action, and, when enforcement is enabled, your Auto-review rules."
And what decides? An LLM-based classifier. Cursor's documentation, which supplies the same engine, is explicit: "Auto-review is not a security boundary. The classifier can make mistakes, " and it describes the run modes as "best-effort guardrails rather than a hard security boundary."
There's a line in Grok Bot's documentation worth reading twice:
"An approval controls the proposed action. It does not reverse work already completed."
Approval governs what's about to happen. What already happened, already happened.
The word that never appears
We searched for inject, malicious, untrusted, phishing, adversarial, hijack, and scam across all 14 pages of Grok Bot's public documentation (1, 889 lines downloaded August 11–12, 2026), the launch post, and xAI's security page. Zero matches. It's reproducible: the pages can be downloaded as markdown.
Scope it correctly: we did not review Cursor's full help center or non-public enterprise documentation, so the accurate statement is that it doesn't appear in Grok Bot's public documentation, not that the company has never addressed it.
Even so the contrast is striking, because prompt injection is the risk of this category: an agent that reads your email and browses the web can receive instructions hidden in that content and execute them believing they came from you. Cursor's documentation opens its agent security page by acknowledging it. And Anthropic's computer-use documentation recommends the exact opposite of what this product sells: "Avoiding giving the model access to sensitive data, such as account login information, to prevent information theft" and "Using computer use within applications that require login increases the risk of bad outcomes as a result of prompt injection."
What does it cost, and how do you get access?
Grok Bot isn't sold separately: it comes bundled with plans that already exist. Verified on the official product page (x.ai/bot) as of August 20, 2026 and cross-checked against Cursor's pricing:
| Plan | Price | Who it's for |
|---|---|---|
| Cursor Ultra | $200/mo, billed monthly | Individuals |
| SuperGrok Heavy | $300/mo, billed monthly | Individuals (highest usage / fastest) |
| Cursor Premium Teams | $120/seat/mo, billed monthly | Teams |
| Enterprise | Available | Organizations |
Watch out for headlines quoting "$120 per month" as the individual price: that's the per seat price of the team plan. The individual prices are $200 (Cursor Ultra) and $300 (SuperGrok Heavy). Official news on 3 September 2026 states that Grok Bot is available for enterprises, with access, network, and audit controls, activated from the Cursor admin dashboard at cursor.com/dashboard/bot.
There is no permanent free tier. The documentation mentions a one-time trial as an access path, but doesn't publish its duration, how much usage it includes, or whether it requires a card. And there's something more important than the entry price: the subscription includes weekly usage, and additional consumption is billed at token cost. The documentation itself admits there is not yet a Grok Bot–specific spend cap. If you try it, watch the usage page from day one.
That's not theoretical. The most detailed first-hand account we found, from a user with a month of early access:
"Biggest downsides are token expenditure. I've used more tokens this month than not this month. That's not a typo, I've used less tokens in the last 5 years prior to this month than I have this month. Always on perpetual agents use a LOT of tokens."
Another user reported burning more than half his weekly quota in three hours of experimenting.
Where is it available?
There is no official information. Neither the product site, nor the announcement, nor the documentation mentions countries, regions, or languages. We can't confirm availability in any particular market, though there's no indication of blocking either.
Which model does it run on?
Official statements from the Grok account confirm that Grok 4.6 has been live in Grok Bot since its August 12, 2026 release. The product still provides no model picker: the documentation states that each request routes to a fixed set of models for its surface, with automatic failover, and that there is no model picker for members or admins. The documentation refers to "models and providers" in the plural and points to the subprocessor clause: a relevant detail if your company has contractual restrictions on who may process its data.
The fine print: what you're actually agreeing to
This is the section that shows up least in the coverage and matters most to you.
The clause that was already written before launch
xAI's consumer terms of service, effective June 26, 2026 (that is, drafted before this launch), define "Agentic Actions" (browsing, executing code, sending communications, modifying files, or interacting with third parties, including financial institutions) and place responsibility on the user:
"We are not responsible for User Content or Agentic Actions. You are responsible for User Content and Agentic Actions... xAI makes no representations regarding the accuracy, safety, or legality of any Agentic Action and disclaims all liability for Agentic Actions to the fullest extent permitted by law."
It's the most consequential clause of the launch. Worth adding the caveat: consumer protection law varies by jurisdiction, and in several, the EU among them, clauses that fully exclude a business's liability can be found unenforceable, so the real reach of this one remains to be seen.
The tension with the terms of the tools it will operate in
There's an unresolved tension between what the product promises and what the terms of the services it will work in actually say.
LinkedIn's user agreement (effective November 3, 2025) prohibits unauthorized automated access and using another party's account via shared credentials or copied cookies, and LinkedIn appears in Grok Bot's own marketing material. Microsoft's services agreement prohibits transferring your account credentials to another user or entity. Google's terms prohibit automated access contrary to robots.txt, though Gmail's refers to crawling and not necessarily to an authenticated session belonging to the account holder.
None of this amounts to a finding of breach: none of these companies has commented on Grok Bot and there is no ruling on the matter. What is verifiable today is that anyone using the agent takes on the risk that the platform reads it as unauthorized automated access, with the usual consequence being account suspension. Check with your legal team before connecting it to corporate tools.
Banking: the line we wouldn't cross
Payment-services regulation in most jurisdictions requires users to take all reasonable steps to protect their personalized security credentials, while placing on the bank the burden of proving fraud or gross negligence if it wants to deny liability. No case law or regulatory decision yet addresses whether delegating a banking session to a cloud AI agent counts as gross negligence, and this article is not legal advice.
The prudent move, and our recommendation, is not to sign in to online banking from the agent's computer: Grok Bot's own documentation warns that all your bots share that machine and its sessions. Also check your bank's digital terms, which are usually stricter than the law.
No audit log, for now
The administrator guide acknowledges that there is currently no audit view of bot actions, and that one is planned: "An audit view of Bot actions is coming."
For a company, that means that until it exists, traceability has to come from the logs of the destination tools if you want to establish who did what, something your own accountability obligations and security audits require of you. The burden of demonstrating it falls on the organization deploying the agent, not the vendor.
A related detail: Grok Bot requires cloud data storage. Cursor's legacy privacy mode, the most restrictive one, "blocks Grok Bot entirely." It cannot be used in the maximum-privacy configuration.
Marketing and documentation don't match
The commercial site's FAQ states that enterprise admins can configure DLP, certificates, proxies, and network controls at machine boot. We reviewed the public administration guide (264 lines) and found no mention of DLP, certificates, or proxies: the only documented controls are static egress IPs, team setup scripts, and the MCP policy inherited from Cursor.
That detail may only be provided to enterprise customers. We've asked the company how those controls are configured and will update this article with the answer.
What does the launch video actually show?
We analyzed the full video in 4K, frame by frame. It runs 106 seconds, contains 69 shot cuts, and its longest continuous shot is 4.7 seconds: not enough to show a task from start to finish.
It isn't a product demo: it's a testimonial ad. People talking to camera about their experience, with B-roll of screens.
We found no "simulated, " "sped up, " or "results not typical" disclaimer in our sampling, though we can't rule out a very brief caption outside the analyzed area. Zooming into the master, conversation titles read "EXAMPLE / DEMO DATA" and one thread is named "testguy, " indicating that at least part of the environment shown is populated with test data. At no point does an indicator appear showing how long the agent takes to complete a task.
And one detail sharpens the tagline. In the only moment where authentication is visible (roughly second 14), the one signing in is the person: one tool card appears marked as skipped, and another, marked complete, consists of the user clicking "Log in with Okta SSO, " completing two-factor, and handing control back.
That isn't a contradiction of the documentation (which says exactly that), but it does qualify the claim: "they sign in to your tools" means, at least with SSO and two-factor, that you open the session.
How does it compare to the other agents that work for you?
The category has three layers, and conflating them is the most common mistake.
(Details of the comparison table and rest of the article remain as previously published; only platforms, Enterprise availability, FAQ OS, and the AI Engineering money-page link were updated in this refresh.)
Four practical rules if you try it
- Never connect banking or high-stakes credentials. All bots share one machine and its sessions.
- Treat the approval classifier as best-effort, not a boundary. The docs say so.
- Watch token spend from day one. There is no Grok Bot–specific spend cap yet.
- Read the Agentic Actions clause before you hand over keys. Liability sits with the user under the current terms.
What this means for people who build and operate agents
Two takeaways that matter more than the product itself.
First: this doesn't replace learning, it changes what's worth learning. The bottleneck for an agent that works on its own isn't its ability to click; that's solved. It's everything else: what permissions you grant, how you verify what it did, what happens when it's wrong, how you audit it. Notice that every serious criticism of this launch is about architecture and governance, not intelligence. That's the work that will exist.
Second: the ability to read technical documentation is a competitive advantage, and this just proved it. Everything that makes this article useful came from reading 1, 889 lines of documentation and comparing them against what the announcement said. No secret source, no inside contact. The difference between coverage that rewrites the press release and coverage you can act on is exactly that, and it's a trainable skill.
If you want to be in the layer that designs these systems rather than the one that absorbs them (agent architecture, orchestration, RAG, evaluation), that's what 4Geeks Academy's AI Engineering program works on. And if you're deciding which tool to adopt, we keep a comparison of AI coding agents current.
Go deeper on Grok Bot
- Grok Bot news and updates: what's changed since the August 2026 launch.
- How to set up Grok Bot: a step-by-step setup walkthrough.
- 10 real Grok Bot use cases: workflows people have actually replicated.