We Read the Security Docs Before the Launch Post
Six days ago, xAI shipped Grok Bot in beta. Three days ago, SpaceX closed its acquisition of Cursor, the company whose servers Grok Bot runs on. We spent the weekend reading the product page, the pricing docs, and the security FAQ, because the security FAQ is where the actual product decisions live.
The short version: Grok Bot is a real always-on agent product, not a chatbot rebrand. It also has the most permissive credential model we have seen from a frontier lab, and the docs say so plainly.
What Grok Bot Is, and What It Is Not
Grok Bot is not the @grok account that answers questions on X. That is a chatbot. Grok Bot is a team of agents, which xAI calls Bots, each of which gets a persistent cloud computer with a browser, a filesystem, and a terminal. You sign a Bot into your existing tools, hand it a multi-step job, and it works while you are away. It comes back only when something needs your approval.
- It does not need an API. A Bot signs into the same web apps a human would and clicks through them, so a vendor with no integration no longer blocks automation.
- It learns by watching. Show a Bot a workflow once and it saves the routine and repeats it on a schedule.
- Bots talk to each other. Multiple Bots share context in threads and run in parallel without you relaying messages.
xAI says its own teams run Bots for overnight account research, CRM cleanup, invoice processing, and bug reproduction. Those are the same jobs we wrote about when Claude gained control of the desktop. The category is crowded now, and the differences are in the plumbing.
Who Actually Runs It
Grok Bot is an xAI product, but the computers are Cursor's. The security docs state that Grok Bot runs only on Cursor-hosted machines, with no on-premises option. That follows from the corporate history: SpaceX agreed to buy Cursor for $60 billion in stock on June 16, having already merged with xAI earlier in the year, and the deal closed on August 14. Grok Bot is the first product built on the combined stack, which means your data processing agreement, residency commitments, and support escalation all run through a rocket company that owns a code editor and a model lab.
What It Costs
There is no standalone Grok Bot SKU. Access comes bundled into three subscriptions: SuperGrok Heavy at $300 per month, Cursor Ultra at $200 per month, and Cursor Teams Premium at $120 per seat per month. Cursor Teams Standard seats at $40 get trial or on-demand usage only. Enterprise is a waitlist.
The number to watch is not the subscription. Each plan includes a weekly usage allowance whose size xAI has not published, and the docs state there is no Grok Bot-specific spend cap yet. Overage bills at Grok 4.6 token rates, and there is no model picker, so you cannot route routine work to a cheaper model. An agent that runs all day on an uncapped meter is a budgeting problem before it is a productivity gain. Have the finance conversation before the first Bot is created, not after the first invoice.
Grok Bot vs Claude Cowork, Managed Agents, ChatGPT Agent, and OpenClaw
We use Claude every day, so read this knowing where we sit. It is still the comparison we would draw for a client who asked us to be fair.
| Grok Bot | Claude Cowork | Claude Managed Agents | ChatGPT agent | OpenClaw | |
|---|---|---|---|---|---|
| Who it is for | Operators who want a delegate, not a developer | Knowledge workers on document and connector work | Developers building production agents | Individuals running browsing tasks from chat | Technical users who self-host |
| Runs where | Cursor-hosted cloud computer, US only | Your desktop, or remote sessions on Anthropic servers | Anthropic sandbox, or self-hosted sandboxes inside your perimeter | OpenAI virtual computer | Your own Mac mini or VPS |
| Always on | Yes, 24/7 with saved routines | Scheduled tasks run with the laptop closed | Yes, billed per session-hour | Per-task, message-capped | Yes, if your hardware stays up |
| Tool access | Signs into any web app as you; no API required | Connectors, MCP, browser use, computer use | MCP tunnels, credential vault, scoped permissions | Connectors plus browser takeover for logins | Messaging apps, shell, whatever you wire in |
| Price | Bundled at $120 to $300 per month; uncapped overage | Included on every paid Claude plan from $20 | API token rates plus $0.08 per session-hour | Plus $20 or Pro $200; 40 or 400 agent messages per month | Free software; you pay for models and hardware |
| Audit trail | Enterprise only; action-level recording off by default | Enterprise admin controls | Every tool call traced in the Console | Enterprise compliance controls | Whatever you build |
The closest product in spirit is OpenClaw: an agent that lives in your tools and messages you. Grok Bot is OpenClaw with the hosting and credential handling taken off your plate, and the control taken with it. The closest product in governance is Claude Managed Agents, which ships scoped permissions, a credential vault, and per-call tracing as defaults but expects a developer to assemble the agent. Grok Bot sits between them, and that gap is where the security questions land.
The Questions to Ask Before You Hand It a Login
xAI's own documentation is direct about the trade-offs. Read it as a checklist.
1. What is the credential scope?
A Bot has no identity of its own. It acts as the signed-in member and can reach anything that member can reach. Within one user, every Bot shares the same computer, and the docs tell you to treat any login or file on that computer as available to every Bot the user runs. Launch-week coverage quoted it more bluntly: do not use separate Bots as a security boundary. Create a dedicated least-privilege account for each job, and never sign a Bot into the owner's admin login.
2. Where is the audit log?
Audit logs are Enterprise only and cover admin, security, and authentication events. Action Recording, which captures what a Bot actually did, is also Enterprise only and off by default. On the plans available today there is no action-level trail, so if a Bot sends the wrong email, reconstructing what happened is on you.
3. Where does the data live?
Grok Bot computers run in the United States today, and a written residency commitment requires contacting the account team. Deleting a Bot does not remove its files or browser sessions from the shared computer. Cleanup is manual.
4. Who controls the approval gate?
Per-command approval is the default, and Auto Review can allow, require approval for, or deny shell commands and computer use. The catch is that each member's own setting is the off switch. There is no organization-level lock, so a team member can turn approvals off and the company cannot prevent it. Nothing in the launch-week docs addresses prompt injection, the primary way an agent reading email gets hijacked. This is shadow AI with a cloud computer attached.
The product is designed so a Bot can finish the job without asking. Every governance control you would want is either Enterprise-only, off by default, or left to the individual member. That is a deliberate choice, and it is the choice you are buying.
Who It Is For
- A good fit: a founder or small team already on Cursor Ultra, with repetitive browser-bound work in tools that have no API, and no regulated data.
- Wait for Enterprise: any company with shared client data or an auditor. Until action recording and an approval lock exist on your plan, you cannot answer the questions above.
- Use something else: teams already on Claude. Scheduled tasks in Cowork cover most of the same routines with connectors instead of shared browser logins, and Managed Agents cover the rest.
Our Take
Grok Bot confirms where every lab is heading: the agent gets its own computer and its own logins, and the human becomes the approver. We build on that assumption with Claude Code every day, and the 204 open-source Claude skills we have published encode how we do it. The pattern works. What Grok Bot changes is how cheap it is to skip the governance step, and cheap governance failures are the ones that end pilots.
Your team will run always-on agents. The deciding factor is not which lab you pick. It is whether the people handing out logins understand what they are handing out. That is a training problem first and a procurement problem second.
Update, September 2026: On August 26, xAI extended Grok Bot to every SuperGrok, Cursor Pro, and Cursor Teams plan, with usage metered separately from the base subscription. On September 3, Grok Bot for Enterprise launched with access, network, and audit controls, and xAI now states that each user's work runs in its own isolated environment. The shared-computer rule within a single user still stands. On our side, 5 of the 21 inbound discovery calls OneWave took in August said an AI assistant had recommended us, and one of those buyers named Grok specifically. The agents are already choosing vendors.
Sources
- Introducing Grok Bot - xAI
- Grok Bot security - xAI Docs
- Grok Bot security FAQ - xAI Docs
- Grok Bot is now included with more plans - xAI
- Grok Bot for Enterprise - xAI
- xAI Launches Grok Bot, Always-On AI Teammates With Their Own Cloud Computers - Unite.AI
- Grok Bot pricing 2026: real plan costs and the uncapped meter - eesel AI
- Grok Bot Security, Explained: What the Shared-Computer Model Means for Your Logins - CellCog
- SpaceX to acquire Cursor for $60B in stock - TechCrunch
- SpaceX officially closes its Cursor acquisition - TechCrunch
- Claude Managed Agents - Anthropic
- ChatGPT agent - OpenAI Help Center