Grok Bot: What It Is, How It Works, and What It Costs

Grok Bot is an AI agent from SpaceXAI (formerly xAI, Elon Musk's company) that works from its own cloud computer: it signs in to your applications, uses them the way you would, and comes back with finished work. It was announced on August 11, 2026 in early beta. It isn't sold separately: it comes bundled with Cursor Ultra ($200/mo) and Cursor Premium Teams ($120/seat/mo).

That's the announcement. This article is about the other part: what its own technical documentation says about where your passwords end up, what the marketing promises that the docs don't back up, and what exactly you take on when you hand a program the keys to your inbox.

How we verified this. Official announcement dated August 11, 2026. Pricing, technical documentation, and reception data checked between August 11 and 12, 2026: we downloaded all 14 pages of Grok Bot's public documentation (1,889 lines), the official pricing table, xAI's terms of service, and Hacker News and Reddit data via API. We have not been able to test the product: it requires a paid subscription and there is no open trial. Where we describe behavior, we describe what the vendor states, not what we observed. Pricing and availability at these companies change often, so check before you buy.

---

What exactly is Grok Bot?

It's a computer-use agent. The difference from a chatbot is that it doesn't answer you: it acts. You assign a task, and it opens a browser, gets into your tools, fills in forms, writes emails, and tells you when it's done.

Each user gets one managed Linux virtual machine in the company's cloud, with a browser, a file system, and a terminal. That's where the agent lives and works, not on your machine.

It isn't a web app or an extension. It's a desktop application for macOS (Apple silicon and Intel) and Windows (x64 and Arm64), plus a companion app for iPhone running iOS 18 or later. The official documentation, updated August 11, 2026, states that Linux desktop, Android, and iPad are not supported at initial launch. If you've read that there's a Linux build, that's a misreading in circulation: the agent's cloud machine is Linux; the app you install is not.

And here's the first fact almost no coverage explains: Grok Bot isn't downloaded from xAI: it's downloaded from Cursor. The installer is served from downloads.cursor.com, signup runs through cursor.com/bot/onboarding, the login is "Sign In with Cursor," and billing shows up in the Cursor dashboard. The documentation states it plainly: "Grok Bot uses Cursor authentication and account data settings."

Which terms actually govern the product is, however, an open question. xAI (X.AI LLC) and Anysphere (Cursor) have separate contracts and privacy policies, with different effective dates, and neither one mentions Grok Bot. Only xAI's governs what it calls "Agentic Actions." We come back to that, because it matters.

The names: Grok Bot, xAI, SpaceXAI, Musk

You'll see all four, so it's worth untangling. Per business press reporting, SpaceX acquired xAI during 2026 and the brand became SpaceXAI; the official site now titles its pages with that suffix while keeping the "© 2026 X.AI LLC" footer. Separately, and also per business press, SpaceX is reported to have agreed to acquire Anysphere, the company behind Cursor, in a deal reported by TheNextWeb and VentureBeat at $60 billion in all-stock consideration, agreed in June 2026. There is still no joint official announcement confirming it as closed, so we treat it as trade-press reporting, not an official fact.

What is verifiable today is the operational fact: Grok Bot is downloaded, authenticated, and billed through Cursor.

---

What is a computer-use agent?

The concept is worth a stop, because it's the category this belongs to and the one you'll watch grow over the coming months.

A computer-use agent is an AI system that operates a computer with mouse and keyboard, looking at the screen, instead of connecting to services through APIs. That's the whole difference, and it explains almost everything else.

Connecting by API is clean: defined permissions, bounded actions, a record of what happened. But it requires the service to have an API, to have it documented, and for the vendor to have integrated it. Driving the computer like a person requires none of that: if you can do it in a browser, so can the agent. It works with your company's ancient CRM, with the intranet that has no API, and with the government portal.

The price of that universality is that the agent inherits your full permissions, with no granularity. It doesn't have "permission to read email." It has your email session, all of it.

Grok Bot combines both paths: API connectors for supported services, and computer use for everything else.

---

How does it sign in to your tools?

This is the line from the announcement: "they sign in to your tools, use them just like you do," and it's where everything interesting lives. There isn't one path. There are three, running simultaneously:

1. OAuth connectors. For supported services, the agent connects through the standard authorization flow, the same one you use when granting a third-party app access. Tokens for hosted servers, per the documentation, stay in Cursor's backend and "the computer never stores those tokens." This is the good path.

2. Human sign-in inside the agent's browser. The bot hands you control of the machine, you type the password, and the session cookie persists on that cloud machine. This is the path that makes the announcement's claim true, and the one that brings the problems.

3. Secure secret request. A masked field for secrets belonging to supported connections. The documentation itself warns: "It is not a general-purpose password manager."

The weakest point in the design, acknowledged by the vendor

This is the fact to understand before any other. The official documentation says, verbatim:

"All of your Bots share one cloud computer assigned to your user account. Files, browser sessions, and command line credentials on that computer are available across your Bot roster."

And in case there were any doubt:

"Do not use separate Bots as a security boundary."

In practice: there is no isolation between bots. If you sign in to your CRM for the "sales bot," the "prospecting bot" (which reads email you don't control and browses sites you've never seen) has that same session open. Constellation Research, independently of the official docs, corroborates the finding: it confirms isolation is "per user, not Grok Bot." Bots get separate screens, but the docs clarify they are "separate work surfaces, not separate security boundaries."

One discrepancy is worth flagging: a user with early access described on Hacker News that each bot runs in its own virtual machine. The official documentation says the opposite. It's a good reminder that early-access testimony is worth checking against the docs, especially on security.

What about two-factor?

It doesn't solve it: it hands it back to you. The default design is a computer takeover: the bot stops and you step into the machine to type the code. The only real automation is forwarding WebAuthn requests from the VM's browser to your desktop app and your physical key, and the documentation notes that Windows support is still in progress.

For teams, the documentation additionally recommends deploying a password manager inside the virtual machine via a setup script, and having members register passkeys. That deserves a second of attention: the recommendation means installing your credential vault on the same machine all your bots share.

---

Does it actually ask permission before acting?

There is an approval mechanism, but it isn't deterministic and there's no published closed list.

The documentation enumerates categories that should require approval: sending messages or invitations, publishing content, purchases and transfers, deleting or overwriting data, changing permissions, touching production, and accepting legal terms. But the official FAQ, asked which actions require approval, answers that it "depends on the tool, the risk of the action, and—when enforcement is enabled—your Auto-review rules."

And what decides? An LLM-based classifier. Cursor's documentation, which supplies the same engine, is explicit: "Auto-review is not a security boundary. The classifier can make mistakes," and it describes the run modes as "best-effort guardrails rather than a hard security boundary."

There's a line in Grok Bot's documentation worth reading twice:

"An approval controls the proposed action. It does not reverse work already completed."

Approval governs what's about to happen. What already happened, already happened.

The word that never appears

We searched for inject, malicious, untrusted, phishing, adversarial, hijack, and scam across all 14 pages of Grok Bot's public documentation (1,889 lines downloaded August 11–12, 2026), the launch post, and xAI's security page. Zero matches. It's reproducible: the pages can be downloaded as markdown.

Scope it correctly: we did not review Cursor's full help center or non-public enterprise documentation, so the accurate statement is that it doesn't appear in Grok Bot's public documentation, not that the company has never addressed it.

Even so the contrast is striking, because prompt injection is the risk of this category: an agent that reads your email and browses the web can receive instructions hidden in that content and execute them believing they came from you. Cursor's documentation opens its agent security page by acknowledging it. And Anthropic's computer-use documentation recommends the exact opposite of what this product sells: "Avoiding giving the model access to sensitive data, such as account login information, to prevent information theft" and "Using computer use within applications that require login increases the risk of bad outcomes as a result of prompt injection."

---

What does it cost, and how do you get access?

Grok Bot isn't sold separately: it comes bundled with plans that already exist. Verified on the official site and cross-checked against Cursor's pricing page:

Watch out for headlines quoting "$120 per month" as the individual price: that's the per seat price of the team plan. The individual price is $200.

There is no permanent free tier. The documentation mentions a one-time trial as an access path, but doesn't publish its duration, how much usage it includes, or whether it requires a card. And there's something more important than the entry price: the subscription includes weekly usage, and additional consumption is billed at token cost. The documentation itself admits there is not yet a Grok Bot–specific spend cap. If you try it, watch the usage page from day one.

That's not theoretical. The most detailed first-hand account we found, from a user with a month of early access:

"Biggest downsides are token expenditure. I've used more tokens this month than not this month. That's not a typo — I've used less tokens in the last 5 years prior to this month than I have this month. Always on perpetual agents use a LOT of tokens."

Another user reported burning more than half his weekly quota in three hours of experimenting.

Where is it available?

There is no official information. Neither the product site, nor the announcement, nor the documentation mentions countries, regions, or languages. We can't confirm availability in any particular market, though there's no indication of blocking either.

Which model does it run on?

xAI doesn't publish it, and has decided not to let you choose. The team guide says "Grok Bot has no model picker, for members or admins," that they don't plan to allow it, and that each request "routes to a fixed set of models for its surface, with automatic failover." The documentation refers to "models and providers" in the plural and points to the subprocessor clause: a relevant detail if your company has contractual restrictions on who may process its data.

There's no basis for attributing Grok Bot to any specific model. If you read that "it runs on Grok 4.5," that's a guess.

---

The fine print: what you're actually agreeing to

This is the section that shows up least in the coverage and matters most to you.

The clause that was already written before launch

xAI's consumer terms of service, effective June 26, 2026 (that is, drafted before this launch), define "Agentic Actions" (browsing, executing code, sending communications, modifying files, or interacting with third parties, including financial institutions) and place responsibility on the user:

"We are not responsible for User Content or Agentic Actions. You are responsible for User Content and Agentic Actions... xAI makes no representations regarding the accuracy, safety, or legality of any Agentic Action and disclaims all liability for Agentic Actions to the fullest extent permitted by law."

It's the most consequential clause of the launch. Worth adding the caveat: consumer protection law varies by jurisdiction, and in several, the EU among them, clauses that fully exclude a business's liability can be found unenforceable, so the real reach of this one remains to be seen.

The tension with the terms of the tools it will operate in

There's an unresolved tension between what the product promises and what the terms of the services it will work in actually say.

LinkedIn's user agreement (effective November 3, 2025) prohibits unauthorized automated access and using another party's account via shared credentials or copied cookies, and LinkedIn appears in Grok Bot's own marketing material. Microsoft's services agreement prohibits transferring your account credentials to another user or entity. Google's terms prohibit automated access contrary to robots.txt, though Gmail's refers to crawling and not necessarily to an authenticated session belonging to the account holder.

None of this amounts to a finding of breach: none of these companies has commented on Grok Bot and there is no ruling on the matter. What is verifiable today is that anyone using the agent takes on the risk that the platform reads it as unauthorized automated access, with the usual consequence being account suspension. Check with your legal team before connecting it to corporate tools.

Banking: the line we wouldn't cross

Payment-services regulation in most jurisdictions requires users to take all reasonable steps to protect their personalized security credentials, while placing on the bank the burden of proving fraud or gross negligence if it wants to deny liability. No case law or regulatory decision yet addresses whether delegating a banking session to a cloud AI agent counts as gross negligence, and this article is not legal advice.

The prudent move, and our recommendation, is not to sign in to online banking from the agent's computer: Grok Bot's own documentation warns that all your bots share that machine and its sessions. Also check your bank's digital terms, which are usually stricter than the law.

No audit log, for now

The administrator guide acknowledges that there is currently no audit view of bot actions, and that one is planned: "An audit view of Bot actions is coming."

For a company, that means that until it exists, traceability has to come from the logs of the destination tools if you want to establish who did what, something your own accountability obligations and security audits require of you. The burden of demonstrating it falls on the organization deploying the agent, not the vendor.

A related detail: Grok Bot requires cloud data storage. Cursor's legacy privacy mode, the most restrictive one, "blocks Grok Bot entirely." It cannot be used in the maximum-privacy configuration.

Marketing and documentation don't match

The commercial site's FAQ states that enterprise admins can configure DLP, certificates, proxies, and network controls at machine boot. We reviewed the public administration guide (264 lines) and found no mention of DLP, certificates, or proxies: the only documented controls are static egress IPs, team setup scripts, and the MCP policy inherited from Cursor.

That detail may only be provided to enterprise customers. We've asked the company how those controls are configured and will update this article with the answer.

---

What does the launch video actually show?

We analyzed the full video in 4K, frame by frame. It runs 106 seconds, contains 69 shot cuts, and its longest continuous shot is 4.7 seconds: not enough to show a task from start to finish.

It isn't a product demo: it's a testimonial ad. People talking to camera about their experience, with B-roll of screens.

We found no "simulated," "sped up," or "results not typical" disclaimer in our sampling, though we can't rule out a very brief caption outside the analyzed area. Zooming into the master, conversation titles read "EXAMPLE / DEMO DATA" and one thread is named "testguy," indicating that at least part of the environment shown is populated with test data. At no point does an indicator appear showing how long the agent takes to complete a task.

And one detail sharpens the tagline. In the only moment where authentication is visible (roughly second 14), the one signing in is the person: one tool card appears marked as skipped, and another, marked complete, consists of the user clicking "Log in with Okta SSO," completing two-factor, and handing control back.

That isn't a contradiction of the documentation (which says exactly that), but it does qualify the claim: "they sign in to your tools" means, at least with SSO and two-factor, that you open the session.

---

How does it compare to the other agents that work for you?

The category has three layers, and conflating them is the most common mistake:

Among agents from the large vendors, Grok Bot is currently the one betting most explicitly on signing in to your tools and keeping the session alive on a machine of its own in the cloud. OpenAI's cloud browser expressly states it does not accept credentials or sign in. Claude Cowork's computer use requires your machine powered on with the app open. Manus and the open source OpenClaw project take approaches closer to xAI's.

We haven't tested any of them: we're comparing documentation against documentation.

---

What are people saying?

Measured on August 12, 2026, less than 24 hours after the announcement, with the caveat that these numbers move a lot in the first days.

The announcement tweet passed 15 million views. Off X, the signal is considerably quieter: the main Hacker News thread stood at 268 points and 221 comments. For calibration: the Claude Cowork launch did 1,298 points, OpenClaw 667. Even xAI's own July 2026 controversies made more noise than this launch.

On Reddit, the week's global search returned 23 results, of which 13 were the same article posted by a single account across 13 different subreddits. In r/singularity, the most AI-enthusiastic subreddit there is, the thread stalled at 11 points, in a week when other AI news in that same forum was clearing 150.

Our read of the dominant themes in the comments comes from our own keyword count across 213 comments, not a manual classification, so treat it as order of magnitude. What dominates isn't what we expected: token cost (15%), a sense of already-seen product (13%), and credentials (10%) rank ahead of abstract security or politics.

The most original criticism isn't technological: it's social. A user with early access described his bot contacting around 40 textile suppliers in Vietnam, negotiating prices, and getting samples made. The top-voted reply:

"Isn't this one of the problems foreseen with this? For you, it was a single prompt — for 40 companies, this probably took up some time. What happens when fifty people fire off a 15-second 'get me a shirt' prompt? When five hundred, five thousand, five million do?"

And on the credential model, two comments that frame the debate better than any analysis:

"AI Session Hijacking is such a dead end and I think this will be the thing that kills it. Just register these things in the IDP and let them sign into their own accounts."

"But then whoever added them to the IDP becomes accountable for what the bots do. By hijacking a real person's credentials, that person becomes the accountability sink. Very neat. Very deliberate."

One note of context: among the commenters offering detail on the beta program is Lee Robinson, who according to his own site currently works at Cursor, the company whose infrastructure underpins the product. We flag it as context for weighing the comment, not as a reproach.

The major press hadn't covered it 15 hours after launch: there's no TechCrunch article. VentureBeat and Unite.AI did cover it, mostly descriptively.

Why there's skepticism, and why it isn't just ideology

Skepticism toward this launch has a concrete precedent. In July 2026 a network-traffic analysis circulated, heavily discussed on Hacker News, claiming that another command-line product from the same house was sending more content to the cloud than requested. We have not independently verified it. We include it because it explains why part of the technical community meets a product that now asks for access to all your sessions with reservations.

---

If you're going to try it: four rules

These four aren't our opinion: they follow from the product's own documentation.

1. Prefer OAuth connectors over signing in by hand in the agent's browser. With Gmail, for instance, permissions are granular and you can revoke them at any time from your Google account's permissions page. A session opened by hand doesn't revoke like that.
2. Don't sign in to banking, payroll, government portals, or anything holding third parties' personal data. Everything you open there becomes available to every one of your bots.
3. Assume there is no separation between bots. If you need real separation, use separate accounts, not separate bots.
4. If your organization processes personal data, don't deploy it without your data protection officer. There's no audit view of agent actions today, and Cursor's maximum-privacy mode blocks the product entirely.

---

What this means if you're learning to code

Two readings, and both matter more than the product itself.

First: this doesn't replace learning, it changes what's worth learning. The bottleneck for an agent that works on its own isn't its ability to click; that's solved. It's everything else: what permissions you grant, how you verify what it did, what happens when it's wrong, how you audit it. Notice that every serious criticism of this launch is about architecture and governance, not intelligence. That's the work that will exist.

Second: the ability to read technical documentation is a competitive advantage, and this just proved it. Everything that makes this article useful came from reading 1,889 lines of documentation and comparing them against what the announcement said. No secret source, no inside contact. The difference between coverage that rewrites the press release and coverage you can act on is exactly that, and it's a trainable skill.

If you want to be in the layer that designs these systems rather than the one that absorbs them (agent architecture, orchestration, RAG, evaluation), that's what 4Geeks Academy's AI Engineering for Developers program works on. And if you're deciding which tool to adopt, we keep a comparison of AI coding agents current.