Meet Grok Bot: xAI's Answer to the Agent Problem
Grok Bot, xAI’s beta AI agent, shares one cloud machine across an account. It reviews plans, permissions, credentials, and real risks.
Grok Bot is an early-beta product from xAI (now branded SpaceXAI) that packages AI agents as “teammates” you message like coworkers: the Bots on an account share a cloud computer of their own, sign in to apps, tools, and websites, and keep working when your machine is off.
If you already run several coding agents in parallel, you have your own answer to the coordination problem: separate worktrees, separate terminal sessions, scripts to stop them trampling each other. Grok Bot claims to absorb all of that into a hosted service. The interesting question is what it gives up in exchange.
Key Takeaways
- Grok Bot, launched in early beta by xAI on August 11, 2026, is a set of messaging-driven agents that share a cloud computer, sign in to your tools, and run while you are offline.
- xAI says multiple Bots work in parallel and pass work between themselves, but Reworked reported that all Bots on an account share one machine, one filesystem, and one set of logins, so they are not separate sandboxes.
- Reworked reported approval gates before sending, publishing, buying, or deleting, human-typed credentials kept out of the transcript, and an “Always Allow” setting that removes the gate.
- Access is bundled with paid SuperGrok and Cursor plans, with no standalone price; the eligible list widened twice in late August 2026.
- Behavior over long unattended runs is still thinly documented, though xAI’s own security pages and several independent write-ups now cover the approval model and the shared-machine design.
What Does xAI Say Grok Bot Is?
According to xAI’s announcement, a Bot is an agent that never clocks off. It gets a machine in the cloud, logs into the software you already pay for, carries a job through to the end, and interrupts you only when a decision needs signing off. You talk to it in a message thread from your desktop or your phone, much as you would with a colleague, and xAI says Bots can also handle services that expose no tidy API or MCP hook. The pitch is aimed at paid work use: sales follow-ups, ops tasks, bug reproduction, reporting. Everything in this paragraph is xAI’s claim, made on its own pages without independent evidence.
What Problem Does Grok Bot Claim to Solve?
The problem Grok Bot targets is the operational overhead of running agents yourself. Running three coding agents concurrently means three worktrees or checkouts, three terminal sessions, lock discipline so they do not collide, and a human shepherding each one from 90% done to actually done. xAI claims Grok Bot removes the hosting (the Bots live on cloud infrastructure, not your laptop), the coordination (Bots message each other and share thread context), and the finish loop (they return completed work rather than a diff to babysit). What it does not claim to replicate, on the evidence available, is the isolation that your worktree setup gives you. That gap is the next section.
Parallel Bots Are Not Isolated Bots
xAI says you can run many Bots at once, working side by side, coordinating in a shared thread, and passing tasks to each other while you look on. But xAI’s own announcement also states that “Bots share a computer of their own in the cloud,” and Reworked reported the security consequence: one isolated Linux box per account, with every Bot the account holder creates working off the same files and the same signed-in sessions. Two Bots are not two security boundaries. In developer terms, parallel Bots here are closer to concurrent processes on one box with one credential set than to the isolated worktrees you maintain now. A misbehaving Bot shares a blast radius with every other Bot you have created.
Can You Teach a Grok Bot by Demonstration?
xAI says a Bot can pick up a workflow by watching you do the job once. Per the product page, what it observes becomes a stored routine it can replay unprompted, and routines can be put on a schedule; the launch post adds that the Bot will take your corrections to that routine. It is the most specific claim on either vendor page: one demonstration in, an unattended repeatable job out. No independent account has yet described how reliably those routines replay.
Plans, Platforms, and What It Can Reach
Grok Bot has no standalone price; access is bundled with paid plans. Per xAI’s own pages, that means SuperGrok, SuperGrok Plus, and SuperGrok Heavy; Cursor Pro, Pro+, and Ultra; and Cursor Teams Standard and Premium. The app runs on desktop, iOS, and Android; Android arrived after the August launch, so older pages that list only desktop and iOS are out of date. Enterprise access is no longer a waitlist either. A September 3, 2026 enterprise release opened it, adding access, network, and audit controls, with an admin switching Grok Bot on from the dashboard and enterprise pricing quoted by sales rather than published. At the August 11 launch only three top tiers qualified: SuperGrok Heavy, Cursor Ultra, and Cursor Teams Premium. The list then widened twice. xAI’s Grok Bot account on X added SuperGrok Plus, Cursor Pro+, and all Cursor Teams plans on August 21, and an August 26 post added base SuperGrok and base Cursor Pro. The launch post was edited to match, without an update stamp. Dollar figures circulating in third-party coverage conflict. xAI’s consistent line is that Bot work draws on its own allowance and does not count against the usage already included in your Grok and Cursor plans. Cursor plans appear on the list because Cursor supplies the Bot’s computer environment; Cursor became a wholly owned SpaceX subsidiary when that acquisition closed on August 14, 2026.
On reach: Reworked reported that the Bot, asked directly in August, put its plugin catalog at 220 entries with none switched on out of the box, spanning tools such as GitHub, Jira, Slack, and Google Workspace, while an August 12 catalog search turned up nothing for HR or ITSM. The catalog has moved since; xAI announced X integration on August 29. Where no plugin exists, Reworked reported, the Bot falls back to working through a browser.
Credentials: Known and Unknown
Most of what is known here comes from Reworked, with xAI’s own Grok Bot security documentation filling in the rest. Reworked reported that the Bot halts and asks before it does anything consequential: sending, publishing, buying, deleting. A separate review model inspects proposed tool calls and actions ahead of execution. Passwords and two-factor prompts hand control back to the person, and what they type stays out of the transcript. An “Always Allow” setting switches the gate off. All of that sits on one shared machine per account.
What is unknown is most of what matters for unattended use: how the gates hold up over long runs, what happens when a task goes wrong mid-flight, and how the browser fallback behaves on sites with no plugin. Grok Bot is a young beta, and the hands-on record is thin rather than absent. xAI and Cursor document the controls in detail, and independent guides walk through the Allow once, Deny, and Always allow choices, but nobody has published a sustained test of what those controls do when a long job goes sideways.
Where That Leaves You
| Claim | Status |
|---|---|
| Bots run in parallel and pass work between themselves | xAI’s claim |
| All Bots on an account share one machine, filesystem, and logins | Reported by Reworked |
| Approval gates before sending, publishing, buying, or deleting | Reported by Reworked |
| Human-typed credentials stay out of the transcript | Reported by Reworked |
| A Bot learns a repeatable routine from one demonstration | xAI’s claim, unverified |
| Behavior over long unattended runs and mid-task failures | No sustained public test |
Grok Bot’s claims map directly onto the pain of running agents by hand, but the detail independent reporting adds cuts against the pitch: parallelism without isolation, on a persistent machine holding live logins. Before handing it credentials, read xAI’s own pages against Reworked’s account and decide whether a shared box with an “Always Allow” switch fits your threat model. Waiting for a sustained public test is a defensible choice.
FAQs
Do multiple Grok Bots run in separate sandboxes?
No. One cloud machine serves the whole account, and every Bot on it works off the same files and the same signed-in sessions, per Reworked's August 2026 reporting. Running several Bots in parallel is closer to running concurrent processes on one box with one credential set than to the isolated worktrees or containers developers use for local agents, so one misbehaving Bot can affect everything the others touch.
Does Grok Bot see your passwords or two-factor codes?
Per Reworked's reporting, no. A login or two-factor prompt hands control back to you, you type the credential yourself, and it stays out of the conversation transcript. The authenticated sessions that result live on the account's single shared machine, where every Bot can use them. xAI's security pages say those browser sessions persist on the member's computer across sessions and that revoking the person in your identity provider ends them.
Which plans include Grok Bot, and does it have its own price?
Grok Bot has no standalone price. Access is bundled with paid SuperGrok plans (SuperGrok, SuperGrok Plus, SuperGrok Heavy) and Cursor plans (Pro, Pro+, Ultra, Teams Standard, Teams Premium), and the app runs on desktop, iOS, and Android. Enterprises no longer join a waitlist: since the September 3, 2026 enterprise release, an admin activates Grok Bot from the dashboard, and pricing is quoted by sales rather than published. xAI states that Grok Bot comes with its own usage, separate from existing Grok and Cursor usage. Eligibility widened twice during August 2026, so check the live x.ai list.
What happens when Grok Bot needs an app with no plugin?
It falls back to driving a web browser directly, per Reworked's August 2026 reporting. In that mode, any password or two-factor prompt stops the Bot until a human types the credentials. No published account yet measures how reliably this fallback works, so the plugin catalog, which the Bot itself put at 220 entries in August before X support arrived, remains the better-documented path.
