Grok Bot security: the shared computer, approvals and what Bots can see (unofficial)

What does "its own computer" mean in Grok Bot?

Short answer: It means one cloud computer per account, shared by all your Bots. Browser logins, files and command-line credentials on it are shared by every Bot. Only the screens are separate, and xAI's docs say "The screens are separate work surfaces, not separate security boundaries."

An official Grok Bot ad says it "works on its own computer, not yours." That's true in one sense: the work happens on a cloud computer, not your laptop. But the computer belongs to your account, not to each Bot. The docs say "All of your Bots use the same cloud computer" and "The computer belongs to your account, not to an individual Bot."

Some xAI pages say the opposite. The x.ai/bot page says "Bots have their own computer", and xAI's 3 Sep 2026 Enterprise post says "Each Bot runs on its own computer in the cloud." We follow the docs, which the x.ai/bot FAQ also backs: "Isolation is per user, not per Grok Bot."

Table: what's shared and what's separate on the Grok Bot computer (last checked 8 Oct 2026)

Between accounts, xAI's docs say "isolation is strict." Inside your account, there is no wall between Bots.

Can one Bot see another Bot's files and logins?

Short answer: Yes. xAI's docs say "Files, browser sessions, and command line credentials on that computer are available across your Bot roster." They also say "Do not use separate Bots as a security boundary."

In practice, if you sign one Bot in to your email, every Bot on the account can use that session. The docs give the rule to follow: "Do not place a credential or file on it if another Bot on your account should not be able to use it."

Does deleting a Bot delete its files? No. xAI's docs say "Deleting a Bot does not remove shared-computer files or browser sessions." Sign out of services and remove files yourself if you no longer want them on the computer.

Can Grok Bot use my own computer?

Short answer: Only if you allow it. Access to your own Mac or Windows computer is a separate setting called Execution on Local Computer. The default is Ask every time, and xAI's docs say "Use Never allow unless a Bot has a specific reason to work on your local files."

The setting is in Settings → General → Bot → Execution on Local Computer, with three choices:

When local access is allowed, Bots can run commands, read files and move files between the cloud computer and your machine through the desktop app.

• The first prompt covers all Bots. It reads "Allow Grok Bot and all Bots to run commands on your local computer?" Choosing Always allow or Never there sets the option for every Bot.
• It's set per computer. Once your account has registered computers, the choice moves to Settings → Computer → Computers, where each computer has its own Execution on this computer setting.
• It doesn't limit the cloud computer. The docs say "These settings do not prevent the Bot from using its cloud computer."
• Teams can set a ceiling. A team admin can cap the setting; when the team's policy is stricter, it wins and Always allow is unavailable.
• Linux is unclear. xAI's approvals page names only "the Mac or Windows computer". xAI doesn't say whether local execution works on a Linux desktop.

A related setting, Route egress through this desktop, sends the cloud computer's web traffic through your desktop. Sites then see your desktop's IP address, and the Bot can reach networks your device can reach, so leave it off unless you need it.

How do approvals and Auto Review work?

Short answer: Auto Review is an independent review model that checks risky Bot actions before they run. It can let an action proceed, ask for your approval, or deny it. You answer approval cards with Allow once, Deny or, when a rule is proposed, Always allow.

xAI's security page lists what Auto Review covers: "shell commands, plugin calls, computer use, automation writes … and delegation such as Cloud Agent and subagent launches." It also says what it misses: "It does not review every side effect. Memory writes and most settings changes are examples."

You can add your own rules in Settings → General → Bot → Auto-review:

• Ask first rules "always stop matching actions for you."
• Allow automatically rules let matching actions through only when the review finds no other reason to stop.
• If both kinds match, "Ask first wins."
• Rules are saved to your account and apply on every desktop you sign in to.

xAI's docs say "Auto Review is model-based and should complement, not replace, least privilege". The same goes for untrusted content: outside content is marked as untrusted, and the docs say these controls "reduce, but do not eliminate, risk from malicious content", which is why consequential actions should stay behind approval. On Enterprise, admins can enforce Auto-review for the whole team; it's off by default.

How do you give a Bot a password safely?

Short answer: Don't type it in chat. For passwords, two-factor codes, CAPTCHAs and payments, use sign-in takeover: you take over the Bot's screen in Agent Computer and enter the details yourself. xAI's docs say "Do not send a password or one-time code in ordinary chat."

For API keys and similar values, there are two safer options:

• Masked secret request. A Bot can ask for a secret in chat through a masked field. You choose Save securely, and Cursor says "The value is not written into the chat." xAI's docs add that the value is kept out of the transcript and isn't shown to the model, but "It is not a general-purpose password manager."
• Bot Secrets. Saved as environment variables. Cursor says "The description is visible to the Bot. The value is not." Saved values are write-only. Team Secrets are Enterprise only.

Hardware security keys are on by default on macOS and Windows, not yet supported on Linux, and every use asks you to approve it first.

Remember that anything a Bot signs in to lands on the shared computer, so every Bot on the account can use that session.

What can Grok Bot connectors do in your name?

Short answer: A connector acts as you. Cursor says a plugin "uses the account you authorize. It can do only what that account can already do in that service. It cannot raise your access, and it cannot change sharing." Installed connectors work for every Bot on the account.

• Bots have no identity of their own. xAI's docs say "A Bot has no identity or credentials of its own"; Bots act as the signed-in member.
• Tokens stay off the computer. "Connector tokens stay on Cursor's backend. Bots invoke tools without receiving OAuth tokens, and tokens are never stored on the computer."
• Connectors are account-wide. "Installed connectors are account-wide. Their availability is not isolated to one Bot."
• Google shows the name "Grok". Grok Bot signs in to Google as Grok, not Cursor, so a Workspace admin may need to trust the app "Grok".
• Blocking a plugin doesn't block the website. For teams, xAI's docs say "Blocking a plugin does not block that service's website."

So connect only the accounts you're happy for every Bot on your roster to use, with the access that account already has.

Does Grok Bot train on your data?

Short answer: It follows your Cursor privacy settings. xAI's docs say "with Privacy Mode enabled, customer data is not used for training." Grok Bot needs cloud data storage, so it doesn't work with Legacy Privacy Mode.

• Training opt-out "follows the applicable Cursor account and privacy settings."
• Teams: "when the setting cannot be verified, the system defaults to not training."
• Model providers: Zero Data Retention follows Cursor's existing provider agreements, so providers don't keep prompts or outputs. They "may run abuse and safety classifiers, and flagged data may be stored for investigation."
• Legacy Privacy Mode: accounts on it must move to a supported Cursor data setting before Grok Bot can start. See the setup guide.

How long does Grok Bot keep your data, and how do you delete it?

Short answer: Deleting your Grok Bot account removes your Bots, chats, computers and plugins, and Cursor says "All data is removed within 30 days." You can't delete Grok Bot without deleting your Cursor account.

• Hibernation isn't deletion. "Idle computers hibernate automatically. Hibernation is not deletion."
• Deleting a Bot leaves files. Shared-computer files and browser sessions stay until you remove them.
• Under Cursor's Data Processing Agreement: data is "deleted or returned within 30 days of written direction after the service ends."
• Backups: xAI's docs mention daily encrypted backups.
• No custom retention: a per-organization retention policy isn't available.
• On iPhone, the app has an in-app Delete Account option.

Where does Grok Bot run, and is it encrypted?

Short answer: Grok Bot runs only on Cursor-hosted cloud computers, and xAI's docs say "Grok Bot computers run in the United States today." The desktop and mobile apps are thin clients, so closing the app or your laptop doesn't stop cloud work.

Running in the US isn't the same as Cursor's US-only data residency program, which the docs say "does not apply to Grok Bot by default." There's no on-premises option and no bring-your-own image.

On encryption, the x.ai/bot page says "Your cloud computer is encrypted in transit and at rest, with training opt-out." xAI's docs don't repeat that line; they point to Cursor's published security documentation and mention daily encrypted backups.

Which security certifications cover Grok Bot?

Short answer: xAI's docs say Anysphere, the company behind Cursor, holds ISO/IEC 27001 and ISO/IEC 42001 certifications, and "Grok Bot is included in the current ISO scope". Cursor also has a SOC 2 Type II attestation, but whether it covers Grok Bot is unknown.

Cursor's security page lists "a SOC 2 Type II attestation" for Cursor. The Grok Bot security page names only the ISO scope, so xAI doesn't say whether Grok Bot is inside the SOC 2 report. xAI's Grok pricing page lists "SOC 2 compliance (Type I & II)" among Grok plan features, but it doesn't say whether that covers Grok Bot. Cursor points to trust.cursor.com for its reports.

Is it safe to share a Bot or install someone else's?

Short answer: Sharing a Bot shares its setup, not your computer. xAI's docs say "A public share link lets others copy the Bot's configuration. It does not share your computer or logins." Installing someone else's Bot is riskier, because it acts through your connected accounts.

• Before you share: xAI's docs say to remove "API keys, internal URLs, customer data, and anything else you would not put in a public document". The terms add that anyone with the link "can view and install your bot's full configuration, including skills, routines, and identity content".
• Before you install: xAI's third-party bot terms say an added bot "may perform actions on your behalf, including reading, writing, and sending data … through your connected accounts", and "SpaceXAI does not verify, endorse, or guarantee the functionality or safety of third-party bots".
• Enterprise: public sharing starts switched off.

What extra security controls do Enterprise teams get?

Short answer: Enterprise adds admin controls: network controls, Action Recording, audit logs, OpenTelemetry export, enforced Auto-review, the MCP allowlist, SCIM and computer management. xAI's docs say dedicated data loss prevention hooks are not available.

• Network: team allowlist modes are Enterprise only, and teams without a policy default to allow all. Computers use "shared static egress IP addresses, and dedicated per-customer IPs are not available."
• Logging: Action Recording, off by default, keeps "scrubbed shell commands, in an internal store with a 90-day retention". The docs say "Grok Bot does not ship a built-in customer-facing telemetry or EDR feed."
• Sign-in: Cursor single sign-on is SAML 2.0, and SCIM 2.0 is on the Enterprise plan.
• Data loss prevention: x.ai/bot says "Enterprise admins can set DLP", but xAI's docs say "Dedicated data loss prevention hooks are not available." We follow the docs: restricting network egress is the available control.

A short Grok Bot safety checklist

Short answer: Set local execution to Never allow, sign in only to accounts every Bot may use, enter passwords through takeover, keep consequential actions behind approval, and clean up files and sessions yourself.

1. Set Execution on Local Computer to Never allow unless a Bot needs your local files.
2. Treat all your Bots as one: anything one Bot can reach, all of them can.
3. Enter passwords, codes and payments through sign-in takeover, never in chat.
4. Use the masked secret field or Bot Secrets for keys.
5. Add Ask first rules for actions that send, pay or delete.
6. Connect only accounts you're happy for every Bot to act as.
7. Scrub secrets before you share a Bot, and read what a third-party Bot can do before you install it.
8. After deleting a Bot, remove its files and sign out of its sessions.
9. Get the app only from x.ai/bot, the App Store or Google Play. See how to spot fake Grok Bot sellers.

FAQ

What does "its own computer" mean in Grok Bot?

It means one cloud computer per account, shared by all your Bots. Browser logins, files and command-line credentials on it are shared by every Bot. Only the screens are separate, and xAI's docs say "The screens are separate work surfaces, not separate security boundaries."

Can one Bot see another Bot's files and logins?

Yes. xAI's docs say "Files, browser sessions, and command line credentials on that computer are available across your Bot roster." They also say "Do not use separate Bots as a security boundary."

Can Grok Bot use my own computer?

Only if you allow it. Access to your own Mac or Windows computer is a separate setting called Execution on Local Computer. The default is Ask every time, and xAI's docs say "Use Never allow unless a Bot has a specific reason to work on your local files."

How do you give a Bot a password safely?

Don't type it in chat. For passwords, two-factor codes, CAPTCHAs and payments, use sign-in takeover: you take over the Bot's screen in Agent Computer and enter the details yourself. xAI's docs say "Do not send a password or one-time code in ordinary chat."

Does Grok Bot train on your data?

It follows your Cursor privacy settings. xAI's docs say "with Privacy Mode enabled, customer data is not used for training." Grok Bot needs cloud data storage, so it doesn't work with Legacy Privacy Mode.

Does deleting a Bot delete its files?

No. xAI's docs say "Deleting a Bot does not remove shared-computer files or browser sessions." Sign out of services and remove files yourself if you no longer want them on the computer.

Which security certifications cover Grok Bot?

xAI's docs say Anysphere, the company behind Cursor, holds ISO/IEC 27001 and ISO/IEC 42001 certifications, and "Grok Bot is included in the current ISO scope". Cursor also has a SOC 2 Type II attestation, but whether it covers Grok Bot is unknown.