The Big Problem with Grok Bots

Somewhere in the Grok Bot documentation, on both the FAQ and the security page, xAI wrote a sentence I keep coming back to: "Do not use separate Bots as a security boundary." Every Bot you create, whether it handles your invoices, your inbox, or your customer chats, shares one cloud computer with every other Bot on your account. Same files. Same browser sessions. Same saved logins.

That is the sentence that decides this post. Not the price, which is good. Not the features, several of which are smarter than anything OpenAI shipped a few weeks later. The architecture.

I run my businesses on an AI staff and I teach design firm owners to build theirs, so when xAI launched always-on "AI teammates" for $20 a month, I read everything they published. My honest take: Grok Bot is a smart idea on the wrong infrastructure, and I won't use it for anything that matters. This post covers why—what the documentation admits that the marketing doesn't—and what a properly owned AI staff looks like instead.

Key Takeaways:

One shared computer: all the Bots on a Grok Bot account run on a single persistent cloud machine, and xAI's own docs say not to treat separate Bots as a security boundary.
You rent, Cursor holds the keys: Grok Bot installs, signs in, and stores data through Cursor. Your training opt-out, retention, and deletion follow Cursor's account settings, not yours.
The meter is hidden: every plan has a weekly usage allowance whose size xAI hasn't published, there is no Grok Bot spend cap yet, and xAI warns an hourly routine can burn a week's allowance in a day.
Three ideas worth copying: one Bot per job, teaching a Bot by recording your screen, and routines that run on a schedule are genuinely good design.
Owning the stack flips every one of these: with Claude Code agents, a Vercel dashboard, and a Supabase database, I decide what each agent can reach, I can read what it knows, and the bills are itemized.

*Affiliate links may be used throughout this article. Read our Privacy Policy for more information.

Table of Contents

What Grok Bot Is (and What It Isn't)

First, the naming problem. Grok Bot is not the @grok you tag under a post on X. That one is a free chatbot that explains threads. Grok Bot is a paid product: named, always-on agents that operate a computer on your behalf, clicking, typing, and signing into websites the way a person would, and keep working after you close your laptop.

You create a Bot, give it a name and a job description, connect the tools it needs, and message it like a coworker from the desktop or iPhone app. It can run a routine on a schedule, learn a reusable skill from a task it finished well, and ask you for approval before it sends, publishes, deletes, buys, or changes anything in production. xAI launched it in beta on August 11, 2026, and on September 28 added Team Bots, which let a whole team share one Bot built around a role.

Four figures: beta launched Aug 11 2026, $20 per month cheapest plan that includes it, 220 plugins at launch, 2 to 6 Bots per group chat — The $20 entry is the number that got everyone's attention. The shared computer is the one that should.

It ships through Cursor, the coding tool SpaceX acquired in June. That matters more than it sounds, and I'll come back to it.

Three ideas worth stealing

I want to be fair to xAI, because three parts of this product are the right idea.

One Bot, one job. Instead of a single assistant juggling everything, you build a roster: a sales researcher, an invoice processor, a bug filer. Peter Yang, who tested Grok Bot and its competitors for weeks, said he preferred this to ChatGPT's one-dot-does-everything approach because you always know which job a reply belongs to. I agree. It is exactly how my own staff is organized.

Teach by watching. Record yourself doing a workflow in the browser, up to ten minutes, and the Bot drafts a skill you can review and test. No API, no code. For a designer who already does the same six clicks every morning, that is the most intuitive way to delegate anyone has shipped.

Routines and skills as separate things. A skill is the procedure. A routine is when it runs. Keeping those apart means you can reuse a skill across Bots and schedule it differently for each.

Three steps: one Bot per job, teach it by recording your screen, run it on a routine — Each of these maps directly onto how a real office delegates.

If the product stopped there, this would be a recommendation. It doesn't stop there.

One Computer for Every Bot

The marketing says each Bot "gets its own computer." The documentation says something narrower: every Bot gets its own screen on one shared computer. All Bots on an account share the same persistent cloud machine, the same filesystem, the same browser sessions, and the same command-line credentials. One Bot can run one computer-use task at a time, so more parallel work means more Bots on the same machine, not more machines.

Then comes the sentence from the top of this post. xAI tells you, in two places, not to use separate Bots as a security boundary. In plain terms: the Bot you built to read your newsletter stats is sitting on the same machine, with the same logins available, as the Bot you built to pay vendors.

Comparison table: each Bot has its own screen, role, memory and one task at a time; all Bots share the computer, filesystem, browser sessions and command-line credentials — The per-Bot column is what the marketing shows. The shared column is what the docs describe.

Think about how you'd staff a real office. Your bookkeeper has the bank login. Your marketing coordinator does not. That separation isn't about trusting one person more than the other. It's about limiting what one mistake, one phishing email, or one compromised account can reach. Grok Bot's design collapses that separation on purpose, so that Bots can hand files and sessions to each other without friction. It's a reasonable engineering tradeoff for a demo. It's a poor one for a firm's back office.

The deletion behavior makes it worse. Deleting a Bot is a soft delete: it removes the profile, conversations, and routines, but files and logins the Bot created can persist on the shared machine. xAI's own guidance is to revoke credentials at the source and, if you might need the work later, to hide the Bot rather than delete it. The agent is gone. Its keys might not be.

Who Actually Owns Your Bots

Here is the part most reviews skip. Grok Bot is an xAI product, but it runs on Cursor. The desktop installer downloads from Cursor's servers. You sign in with a Cursor account. And the data settings that matter, whether your work can be used for training, how long it's retained, and what deletion means, follow your Cursor account and Cursor's terms, not a Grok Bot setting you control. Cloud storage is mandatory; the privacy mode Cursor used to offer isn't supported here.

So the honest answer to "who owns my Bots" is: you own the job descriptions you typed. The machine, the sessions, the files, the memory the Bots build up about your business, and the rules about what happens to all of it live with a vendor, governed by a second vendor's terms, under a parent company that bought both of them this year.

Comparison table: you hold the Bot names, job descriptions and approval choices; Cursor and xAI hold the machine, the sign-in, training and retention settings, the model choice, the allowance size and export — Two vendors, one parent company, and your Bots live on their side of the line.

That isn't a knock on Cursor. It's a description of what you're signing. If you cancel, there is no export of the staff you spent months training. If the terms change, your Bots change with them. If the company decides a feature should move up a tier, the Bot you depend on moves with it.

And the memory is opaque in the same way a ChatGPT dot's memory is. Each Bot keeps its own role, preferences, and summaries of past work. There is no page where you read what your invoice Bot has concluded about your cash position, and no way to correct a single wrong conclusion. I wrote about why that matters in my post on ChatGPT dots, and every word of it applies here.

The Fine Print

Four more items from the documentation that didn't make the launch video.

The allowance is unpublished. Every plan that includes Grok Bot comes with a weekly usage allowance. Nowhere on the product page or in the docs does xAI say how large that allowance is, in tokens or in dollars. When you exceed it, on-demand usage is billed from model and token cost. The teams documentation states plainly that there is no Grok Bot-specific spend cap yet. And xAI's own usage notes warn that an hourly routine can consume a week's allowance in a single day. Read those three facts together: a meter you can't see, no ceiling, and a feature that can empty it before lunch.

Bar chart of monthly prices: Cursor Pro $20, SuperGrok $30, Cursor Pro+ $60, SuperGrok Plus $100, Cursor Premium Teams $120 per seat, Cursor Ultra $200, SuperGrok Heavy $300 — Every bar includes a weekly allowance of unpublished size. None has a spend cap.

The price has moved three times in seven weeks. At launch on August 11 you needed a $200 or $300 plan. Ten days later the floor dropped to about $100. On August 26 it dropped again to $20 through Cursor Pro or $30 through SuperGrok. Cheaper is good news. But a product whose entry price fell by 93 percent in two weeks is a product still figuring out what it costs to run, and that bill eventually lands somewhere.

Timeline: Aug 11 beta at $200 to $300 plans; Aug 21 floor drops to about $100 with a 7-day trial; Aug 26 included with $20 Cursor Pro and $30 SuperGrok; Sep 3 enterprise controls; Sep 28 Team Bots; Sep 29 dot.com redirects to Grok Bot — The entry price fell from $200 to $20 in fifteen days.

Nobody will tell you which model it runs. The launch post doesn't name it. The product page doesn't. The documentation doesn't. There is no model picker, for members or admins. One pricing analysis read the docs as routing to Grok 4.6, but xAI itself has not said so. For a tool that will read your contracts and write to your customers, "we won't say what's doing the thinking" is a strange place to start.

The vendor's own founder ranks the competition first. Under oath in April 2026, Elon Musk said he ranked Anthropic first, then OpenAI, then Google. In July he said Anthropic was "currently the leader in AI" and that Grok "had fallen short, particularly at coding." I don't say that to pile on. I say it because the model I build on is the one he named.

Two smaller things: browser-driven automation gets blocked and hits CAPTCHAs, which hands the task back to you at the exact moment you wanted it handled, and the Windows version of the Team Bots app was unspecified at launch, with Android still "coming soon."

What I Run Instead

My AI staff has been running since the spring, and it does the jobs Grok Bot advertises on infrastructure I control. Here is the shape of it.

Claude Code agents are the workforce. Each agent is a Claude Code agent with a written charter, a markdown file that spells out its job, what it reads before acting, what it may do alone, and what it brings to me. Five executive personas, Olive, Mark, Sally, Frank, and Pete, sit over 20 specialist agents. They run on schedules from two small servers and a PC in my house. Every charter is in a Git repository with its full history.

Vercel hosts the command center. A Next.js dashboard where I see the org chart, read what each agent is doing, approve or reject work, and watch the numbers. Vercel's scheduled jobs kick off the recurring work. It's a standard web app that any developer could maintain.

Supabase is the brain. Plain Postgres that I own: agent runs and logs, every approval I've ever given, the blog and sales pipelines, customer records, revenue, and media storage. I can query it, export it, and move it to any Postgres host.

Five steps: the agent wakes on schedule and reads its charter, pulls context from Supabase, does the work, writes results back to Supabase and pings John on Telegram if needed, and John approves on the Vercel dashboard — The dashboard and the agents read the same database, so what I see is what they see.

I'll be straight about one thing, since this post is about shared machines: my agents share servers too. Twenty agents don't get twenty computers. The difference isn't that mine are magically isolated. The difference is who decides what each one can reach, who can see it, and what happens when one is retired. That's the next section.

Five Differences That Decide It

1. I decide which agent holds which key

Each charter names the tools and accounts its agent may use. The bill-pay agent has a card. The blog writer does not. The sales agents can read the DM inbox; the social agents cannot. When I retired a sales server last month, the credentials on it were revoked at the source the same day, which is exactly the step xAI tells you to remember to do yourself after a soft delete. In my system it's part of the procedure, not a tip in the FAQ.

Comparison table of four agents against four credentials: only the bill-pay agent holds the company card, only the sales agents read the DM inbox, only the webmaster can deploy the site, and the blog writer holds none of them — Each charter names what its agent may touch. A Bot on a shared machine has access to whatever the machine has.

2. I can read what my staff knows

Everything my agents remember lives in a database and a vault of notes I can open. I can see what Sally has concluded about a lead, correct it, or delete that single line. Grok Bot's per-Bot memory is undocumented and uneditable. If you run a design firm, the ability to audit what an AI believes about your clients is not a nice-to-have.

Four steps: an agent reaches a conclusion, it is written to Supabase or the vault, John reads it on the dashboard, John corrects or deletes that single line — Grok Bot's per-Bot memory has no step three or four.

3. The model is my choice, and I know what it is

My agents run on Claude, and I pick the version per job. When a better or cheaper model ships, I change a setting. Grok Bot has no model picker and won't name the model it routes to. You're renting a mind without a label.

4. The bills are itemized and the vendors are replaceable

I pay Anthropic for tokens, Vercel for hosting, Supabase for the database, and a hosting company for two small servers. Four line items I can read. Nothing is bundled into a weekly allowance of unknown size with no cap. And each piece swaps independently: a different model, a different host, a different database provider, without touching the others.

Comparison table: Grok Bot has an unpublished weekly allowance, no spend cap, an unnamed model, and bundled billing; the owned stack has itemized bills per vendor, caps you set, a model you choose, and vendors you can swap — Every row on the left is a fact from xAI's own documentation.

5. Approvals are mine, logged, and queryable

Grok Bot's approval buttons, Allow once, Deny, Always allow, are the right shape, and its model-based Auto Review is a good second check. Mine work the same way with one difference: every approval is a row in my database. Nothing goes to a customer, onto a website, or into an email broadcast without that row. If I want every approval I gave in September, it's one query. If I want to know why an agent did something, I read its charter and its log.

And the Grok Bot feature I'd most like to borrow, teaching a Bot by recording your screen? I already do a version of it. When I want an agent to learn a vendor's billing site, I record a short walkthrough video, drop it in, and an agent turns it into a written skill I review before it runs. Same idea, except the result is a file in my repo instead of a routine on someone else's machine.

Four steps: record a short walkthrough video, drop it in for an agent, the agent drafts a written skill, John reviews it before it ever runs — Same idea as Grok Bot's teach-by-watching, except the result is a file in my repo.

When Grok Bot Is the Right Call Anyway

If you already pay for Cursor or SuperGrok, Grok Bot is effectively free to try, and the one-Bot-one-job model is a good way to learn what delegating to an AI feels like. For low-stakes work on accounts you'd happily share with an intern, such as researching outlier YouTube videos, scouting posts in your niche, or tidying a reading list, it is a fast on-ramp, and the teach-by-watching feature is a joy.

Where I'd draw the line is the same place I drew it for dots: the moment a Bot would hold a login to your bank, your client files, your customer conversations, or your email domain. At that point the shared machine, the unpublished meter, the unnamed model, and the second vendor's terms stop being footnotes and become the decision. For that work, build it on ground you own.

Comparison table: researching videos, scouting posts, and tidying a reading list are fine for a Grok Bot; holding a bank login, client files, customer conversations, or your email domain belongs on ground you own — The line is the same one I drew for ChatGPT dots: convenience on one side, your firm's keys on the other.

Frequently Asked Questions

What is Grok Bot?

Grok Bot is xAI's always-on AI agent product, launched in beta on August 11, 2026. You create named Bots with job descriptions; they run on a cloud computer, sign into your tools, follow routines on a schedule, and ask for approval before consequential actions. It is distributed through Cursor and is separate from the free @grok chatbot on X.

How much does Grok Bot cost?

There is no standalone plan. Since August 26, 2026 it is included with Cursor Pro ($20 per month), SuperGrok ($30), and higher tiers up to SuperGrok Heavy ($300). Each plan includes a weekly usage allowance whose size xAI has not published, with on-demand overage billed by token cost and no Grok Bot spend cap yet.

Do Grok Bots run on separate computers?

No. All Bots on an account share one persistent cloud computer, including its files, browser sessions, and command-line credentials. Each Bot gets its own screen. xAI's documentation states, on both the FAQ and the security page, "Do not use separate Bots as a security boundary."

What are Grok Team Bots?

Team Bots, launched September 28, 2026 in public beta on Teams and Enterprise plans, are shared Bots built around a role a team has in common. They combine shared context, plugins, credentials, and memory, keep each person's conversations private, and come with templates for sales, product management, marketing, and data analytics.

What do you use instead of Grok Bot?

An AI staff built on Claude Code agents, a Next.js dashboard on Vercel, and a Supabase Postgres database. Five executive personas and 20 specialist agents run on schedules from two small servers and a home PC. Each agent's charter is a file in a Git repo that names the tools it may use, every approval is a row in a database I own, and I choose the model.

Grok Bot gets the picture right: a roster of named AI teammates, each with one job, learning from you and working while you sleep. I've run my businesses that way for months. But the picture and the implementation are different things. xAI put a great idea on one shared computer, behind a hidden meter, under two vendors' terms, with a model nobody will name. For anything that touches your clients, your money, or your email domain, I don't recommend it. Build the roster on ground you own.