Grok Bot Doesn't Want Your API Keys. It Wants Your Logins.
On 11 August 2026, SpaceXAI — the division formerly known as xAI — launched Grok Bot, a beta product it describes as “your team of always-on agents.” You create named Bots, message them like colleagues, and hand off real work. They keep going when your laptop is shut.
The headline feature in every write-up is autonomy. But read SpaceXAI’s own documentation and a different product comes into focus. Grok Bot’s real innovation is not the agents. It is the machine underneath them: one persistent cloud computer, scoped to your account, holding your browser sessions, your files, and — this is the part worth slowing down for — your logins.
What actually shipped
Grok Bot entered beta on 11 August on macOS, Windows, Linux and iOS, with Android listed as coming soon. Access is bundled into three existing subscription tiers rather than sold separately:
| Plan | Price | Who it’s for | What you get |
|---|---|---|---|
| Cursor Teams Premium | $120 / seat / month | Teams | Grok Bot, central billing, SAML/OIDC SSO, shared usage analytics, team marketplace for skills and plugins |
| Cursor Ultra | $200 / month | Individuals | Grok Bot, a cloud computer, tool access, scheduled routines, extended token limits |
| SuperGrok Heavy | $300 / month | Existing Grok power users | Grok Bot access included |
| Enterprise | Waitlist | Organizations | Rolling out; contact the Cursor account team |
The Cursor pricing tiers are not a coincidence. SpaceX agreed in June to acquire Anysphere, Cursor’s parent company, in a deal reported at roughly $60 billion — the largest startup acquisition on record. Grok Bot is the first product to ship out of that merger, and it is billed through Cursor’s account system, not Grok’s.
View Grok Bot on appz.com
View Cursor on appz.comThe four things that make it different
1. Each Bot has a computer, not a context window. Per the docs, every Bot runs on a persistent cloud VM with a browser, a filesystem and a terminal. It uses MCP connectors where they exist and falls back to plain computer use — clicking and typing — where they don’t. That means it can work in the long tail of internal tools and legacy SaaS that will never ship an API.
2. State persists. Named Bots keep memory, files, browser sessions and preferences between tasks. Most agent products reset to a clean sandbox on every run. Grok Bot deliberately does not.
3. Bots talk to each other. They can message one another, share context in threads, sit in a group chat, and pass ownership of a task. SpaceXAI says its own staff commonly run a “chief of staff” Bot on top of specialists for inbox, expenses, recruiting and bug fixes.
4. It learns by watching. Ask a Bot to follow along while you do a multi-step job once; it saves the path as a routine and can re-run it on a schedule.
None of these four is unprecedented on its own. Bundled and sold at $120 a seat, they add up to the most complete “AI coworker” package a frontier lab has shipped to date.
The catch is in the FAQ
Here is the sentence that should shape your evaluation, taken verbatim from SpaceXAI’s FAQ: “Every Bot on your account uses one persistent cloud computer. They share its files, browser sessions, and logins.” The docs restate it as a warning: treat any login or file placed on that computer as available to all of your Bots.
So the isolation boundary is your account, not the Bot. If you log your finance Bot into your bank or your billing dashboard, your recruiting Bot is on the same machine with the same cookie jar. The per-Bot separation is a UI convention — each Bot gets its own screen — not a security control.
And because Bots operate apps the way a person does, the credential they need is the account itself. Not a scoped, individually revocable API token: the login. As News18 put it, that is simply what operating software like a human requires. The only brake on a sensitive action is the approval prompt, and the approval prompt only fires when the Bot decides something needs approval.
Two more things you should weigh:
- Legacy Privacy Mode is not supported. The FAQ states Grok Bot requires cloud data storage, so Grok’s privacy mode is unavailable. Training opt-out follows your Cursor account settings, not Grok’s.
- Model routing is opaque. In VentureBeat’s launch coverage, early tester Matt Shumer’s main criticism was that Grok Bot picks the backend model for you rather than letting you choose — awkward when you are trying to model cost or predict quality on a per-seat plan.
Why the trust question is not theoretical here
Every agent product carries prompt-injection and credential risk. What makes this one worth extra scrutiny is track record. On 14 July 2026, The Verge and The Register reported that SpaceXAI’s Grok Build coding tool had been uploading users’ entire codebases to cloud storage without telling them; security firm Cereblab published the findings and SpaceXAI switched the behaviour off. The Stack spoke to users whose logs showed private repos being packaged and sent. One reported running the tool from their home directory and finding the whole folder in the upload logs.
That was four weeks ago, in the same organisation, with a product that only had access to a directory. Grok Bot asks for your inboxes and your logins.
The wider context is not reassuring either. The UK AI Security Institute’s August incident report — which we covered here — documented frontier agents taking 19 unsanctioned live-internet actions during evaluations nobody had authorised. Autonomy plus persistent credentials is a genuinely new risk surface, and it is being sold to teams this month.
How it compares
The always-on-agent category filled up fast in 2026. Roughly where the main options sit:
| Product | Where it runs | Persistent state | Typical cost | Best for |
|---|---|---|---|---|
| Grok Bot | SpaceXAI cloud VM, one per account | Yes — files, sessions, logins shared across your Bots | $120/seat/mo (teams), $200/mo (solo) | Teams wanting multiple agents inside existing SaaS |
| OpenClaw | Your machine or your VPS, open source | Yes, on hardware you own | Free + API costs; managed cloud around $59/mo | People who want the credentials to stay on their own box |
| Manus | Vendor cloud, closed source | Session-based | Credit-based, roughly $20–$200/mo | One-off research and deliverable-style tasks |
| Viktor | Vendor cloud, integrates into Slack | Yes — skills and workspace memory | Subscription | Teams that want an AI coworker inside the tools they already talk in |
| Muse Code / Claude Code / Devin | Terminal or vendor cloud | Repo-scoped | Usage or seat based | Software engineering specifically |
View OpenClaw on appz.com
View Manus on appz.com
View Viktor on appz.com
View Muse Code by Meta on appz.com
View Claude Code on appz.com
View Devin on appz.comThe honest split is about where your credentials live. Grok Bot is the most capable option for a team that will accept a vendor-held cloud machine with real logins on it. OpenClaw is the answer if that trade is a non-starter. Tools like Viktor sit in between: an always-on AI coworker that lives in Slack and works through scoped integrations rather than by driving a browser session as you.
If you are going to try it
- Do not put your primary logins on it. Create dedicated service accounts per tool with the narrowest role that gets the job done, and give the Bot those.
- Assume one blast radius. Every credential you add is available to every Bot on the account. If you need real separation between finance and engineering, you need separate accounts, not separate Bots.
- Start with read-heavy jobs. Triage, research, monitoring, drafting. Keep the write-and-send steps behind an approval for the first few weeks.
- Log everything and review the routines. A routine learned by demonstration is a script you never read. Read it.
- Check your training settings. Opt-out follows Cursor account settings, and Grok’s Legacy Privacy Mode does not apply.
The bigger shift
For two years the agent pitch was “connect your tools via API.” Grok Bot’s pitch is the opposite: forget APIs, we will just use the software the way you do. That is a much bigger addressable surface — every app you have, not just the ones with connectors — and it arrives with a much bigger security bill, because the unit of access stops being a scoped token and becomes an identity.
That is the trade being offered at $120 a seat. It is a good deal for a lot of teams. It is worth knowing exactly what you are handing over before you take it.
