What Is Grok Bot? xAI’s Always-On Agents, Explained for Small Teams

Grok Bot is xAI’s set of always-on AI agents that share one cloud computer, take instructions by message, and stop for approval before sensitive steps. xAI launched it on August 11, 2026. You do not buy it on its own. It comes with a paid Cursor account or a linked SuperGrok subscription.

Most early coverage treats it as a rival to Claude Cowork or ChatGPT agent and stops at the feature list. This piece walks through how you get Grok Bot, what it costs, how the shared computer works, what stops for approval, how logins and data are handled, and which admin controls each plan has. It closes with a checklist for small agencies, nonprofits and associations.

The short version: every Bot on one person’s account shares the same computer, files, browser sessions and logins. xAI’s own docs say not to treat separate Bots as a security boundary. On a self-serve Cursor Teams plan, Grok Bot is on for every member and an admin cannot switch it off. Network controls, enforced review and audit logs are Enterprise only. Decide whether that fits your organization before you connect a CRM, inbox or donor system.

What Grok Bot is and what it does

xAI’s launch post describes Grok Bot as "your team of always-on agents" that "have their own computer, work inside tools and apps like you do, and keep working 24/7." The xAI release notes for August 11 call them "durable AI teammates that work on a persistent cloud computer, with messaging, approvals, connectors, and routines."

Each Bot has a name, a job and memory that carries over between tasks. Our explainer on what AI agents are covers the general idea.

Cursor’s Grok Bot documentation says each Bot "works on a persistent cloud computer with a browser, filesystem, and terminal." Work keeps running when you close the app, your laptop or your phone.

You talk to Bots by typing, dictating or starting a voice chat. Bots can use connected tools, run saved skills, and repeat jobs on a schedule as routines. Two to six Bots can also work together in a group chat and hand work to each other.

The apps run on macOS, Windows and Linux, plus iPhone, iPad and Android, according to xAI’s FAQ. xAI’s launch post called the product a beta available on desktop and iOS. The current docs do not use the beta label.

Grok Bot is a separate product from the Grok chat app. Our Grok explainer covers the chatbot and model family, and our Grok 4.6 coverage noted the Grok Bot launch.

How you get Grok Bot: Cursor accounts and SuperGrok links

Grok Bot runs on Cursor accounts. Cursor’s getting started guide says: "Grok Bot uses your Cursor account, and there is no separate Grok Bot login." You download the desktop app from the Cursor dashboard and sign in there.

xAI’s Grok Bot FAQ (updated September 21, 2026) says the product is "included with every paid individual Cursor plan and with the Cursor Teams plan." It adds that you can link an individual SuperGrok, SuperGrok Plus or SuperGrok Heavy subscription.

The sources disagree on one point. Cursor’s plans help page also lists X Premium+ as a subscription you can link. xAI’s FAQ and its two Grok Bot news posts name only the SuperGrok tiers. If you plan to rely on X Premium+, confirm it in the app before you pay for anything.

Cursor’s help page also says SuperGrok Team, SuperGrok Enterprise and SuperGrok Lite cannot be linked. And it says plainly that "a Cursor plan and a SuperGrok or X Premium+ link do not stack." Linking a second subscription does not add more Grok Bot usage.

Why Cursor? Cursor announced on August 14, 2026 that it "has officially been acquired by SpaceX," which also owns xAI. xAI’s docs now carry the SpaceXAI name.

What Grok Bot costs to try

Grok Bot has no price of its own. You pay for the plan that includes it. xAI’s August 26 post says the product "comes with its own usage, separate from your Grok and Cursor plans."

The prices we could confirm, as of September 29, 2026:

Sources: Cursor pricing, xAI’s Grok Bot page and Cursor’s plans help page.

Paid access includes weekly usage that resets each week. Neither xAI nor Cursor publishes how much work that covers. When it runs out, extra work can continue as on-demand usage, billed through Cursor, if on-demand is turned on. The FAQ says on-demand is "billed from model and token cost."

The trial is a usage credit, not a fixed number of days, "though a 7-day window also applies," per Cursor. Credit is spent by the steps and tokens a Bot uses, not by message count.

One cloud computer shared by every Bot

This is the design fact that should shape your setup. xAI’s FAQ answers it directly: "Every Bot on your account uses one persistent cloud computer. They share its files, browser sessions, and logins so they can hand work off."

xAI’s approvals, security and privacy page (updated September 28, 2026) draws the conclusion: "Do not use separate Bots as a security boundary."

Consider what that means for a small team. Say one staff member creates a research Bot and a donor outreach Bot. If the outreach Bot signs in to the CRM, the research Bot runs on the same computer with the same session. Anything one Bot downloads, the others can open.

Stored browser sessions matter here. A signed-in session on a shared computer is worth protecting. Our piece on infostealers and AI session hijacking covers why attackers target live sessions. Our guide to agentic browser security covers the wider risks of agents that browse for you.

Per Cursor’s security docs, the computers are Cursor-hosted only, with no on-premises option, and they operate in the United States.

What stops for approval, and what does not

xAI’s approvals page lists the actions that should stop and ask first:

• Sending messages or invitations
• Publishing content
• Purchases and financial transfers
• Deleting or overwriting data
• Changing permissions
• Production changes
• Accepting legal terms

An automatic check called Auto-review sits between the Bot and those actions. It covers shell commands, plugin calls and automation writes. An action goes ahead when Auto-review finds no risk, or when it matches a rule you set to "Allow automatically." A matching "Ask first" rule always stops it. Per Cursor’s Grok Bot security page, "Ask first wins when rules conflict."

When a Bot asks, you get three choices: Allow once, Always allow or Deny. Always allow saves a rule, so use it with care.

Two limits matter. First, Cursor says Auto-review "doesn’t review every side effect. Memory writes and most settings changes are examples." Second, xAI says: "An approval controls the proposed action. It does not reverse work already completed." If a Bot has already changed ten records before it asks about the eleventh, saying no stops only the eleventh. Our write-up of an agent write-access incident shows how that plays out.

Commands on your own desktop are handled separately. According to Cursor’s settings page, local commands need approval one at a time by default.

Logins, passwords and connector tokens

Grok Bot is built to keep passwords out of the chat. Cursor’s security page says: "For login, two-factor, and payment steps, the Bot hands the computer to the member rather than typing credentials." You sign in yourself, then hand control back.

When a Bot needs a secret value, it can send a secure request. Cursor says the request masks what you type and keeps it out of the transcript and away from the model.

Connected tools work differently. "Bots invoke tools without receiving OAuth tokens, and tokens are never stored on the computer," per Cursor. The tokens stay on Cursor’s backend.

Bots act as the signed-in member, with no separate machine credentials. Grok Bot uses your Cursor single sign-on if you have one.

A 1Password integration has been announced on X and reported in the trade press. As of September 29, 2026, we found no xAI, Cursor or 1Password documentation for it. Treat it as announced, not documented.

For the basics a small office should have in place first, see our guide to password security for small businesses.

Data, training and what survives deleting a Bot

Grok Bot follows your Cursor data settings. The xAI FAQ says: "Training opt-out follows the applicable Cursor account and privacy settings." Cursor’s security page says that with Privacy Mode on, "customer data is not used for training."

One setting blocks the product. Grok Bot needs cloud data storage, so it does not work with Cursor’s Legacy Privacy Mode. An account on that mode must change it before starting.

Model providers honor zero data retention under Cursor’s agreements, per its security page, though they may run safety classifiers on flagged content. Under Cursor’s data processing agreement, data "is deleted or returned within 30 days of written direction after the service ends."

Deleting a Bot is not the same as deleting its work. The FAQ says deletion removes the Bot’s profile, conversation and routines. "Because Bots share a computer, files and logins on that computer may remain."

xAI’s product page says the cloud computer is "encrypted in transit and at rest." The security docs mention daily encrypted backups but name no encryption standards.

On certifications, Cursor says Anysphere, the company behind Cursor, holds ISO/IEC 27001 and ISO/IEC 42001, issued by Schellman, with Grok Bot in the current scope. The security page does not mention SOC 2.

Teams versus Enterprise: who can switch it off

This is where plan choice matters most. xAI’s teams and enterprises page says: "On the Teams plan, Grok Bot is enabled by default, and every member has access without any admin action." Cursor’s teams page adds that there is no switch to turn it off.

A Teams admin can still set some things, according to Cursor’s team docs:

• Team rules: instructions every member’s Bots follow.
• Connector policy: which marketplace plugins members can use.
• Local execution: whether Bots can run commands on a member’s desktop.
• Cloud agents and template sharing: both can be turned off.

The rest is Enterprise only: the organization-wide on and off switch, SCIM provisioning, Network Controls, Team Setup and Team Secrets, enforced Auto-review, Auto-review rules, Action Recording, audit logs and computer management. Action Recording keeps 90 days of Bot actions and is off by default.

Enterprise access itself is still arriving. xAI’s FAQ says "Enterprise access is rolling out," and Cursor’s help page says to ask your account executive.

Connectors follow the same policy you already set for Cursor. "There is no separate Grok Bot connector list," xAI says. A blocked plugin shows as "Disabled by team admin."

Tasks that fit a small agency or nonprofit

xAI’s launch examples lean toward sales and operations: prospect research, CRM updates, onboarding and invoices. The safer starting point is work that reads more than it writes:

• Research and briefs: background on a funder, a prospect or a vendor before a meeting.
• Meeting prep: pull the last few emails and notes into one summary.
• CRM lookups: find records and report what is missing, without editing.
• Inbox triage into drafts: sort messages and write replies that wait for a person to send.

Cursor’s help page names Gmail, Google Calendar, Drive, Docs, Sheets, Slides, Slack, Notion and Zoom as connectors. The Cursor Marketplace also lists plugins for Salesforce, HubSpot and other sales tools. Which ones work for you depends on what your team admin allows. Many are built on the Model Context Protocol, which our MCP explainer covers.

xAI also published a case study on running its own support with Grok Bot, Plain, Linear and Datadog. Staff reviewed its proposed responses by hand on the first day. xAI says ticket volume rose 175% without adding staff. Those are xAI’s own figures about its own product.

Leave sending, publishing, payments and deletions until you have watched a Bot work for a few weeks.

How Grok Bot compares with Claude Cowork and ChatGPT agent

The three products take different approaches. This table sets out facts from each vendor’s documentation. It does not rank them.

Sources: Anthropic’s Cowork help for Team and Enterprise and OpenAI’s ChatGPT agent help.

On logins, ChatGPT agent pauses and asks you to take control of its browser, and it asks for confirmation before high-impact actions. Grok Bot hands you the cloud computer for the same kind of step. Our pieces on Claude Cowork cloud sessions and the Claude Cowork merger cover the Anthropic side in more depth.

Microsoft’s Copilot Studio takes another route. Its computer use can run in a hosted browser or a Cloud PC pool, both in preview and "not recommended for production use," or on your own Windows machines.

Before you connect an org account

Use this list before any Bot touches a CRM, shared inbox or donor database:

• One person, one account. Do not share a login across staff. The shared computer makes that one exposure.
• Write narrow approval rules. For example: “Ask first before sending any external email.” Avoid Always allow on anything that sends or deletes.
• Hand off logins. Sign in yourself when the Bot hands you the computer. Never paste a password into chat.
• Check data settings. Confirm Privacy Mode, and move off Legacy Privacy Mode if needed.
• Review allowed plugins. On Teams, your Cursor connector policy is the main control you have.
• Test on a sandbox first. Use a test CRM or a copy of the data before live records.
• Clean up. Sign out and remove files when a task ends, since deleting a Bot may leave them behind.

If you are buying seats for a team, our guide to AI vendor usage policies in procurement covers the contract questions to ask.

What we still do not know about Grok Bot

Several basics are not public as of September 29, 2026.

• The model. Cursor says it “manages model selection, so there’s no model picker.” No page names the model. xAI’s docs show a site-wide banner for Grok 4.7, but that is not a statement about Grok Bot. Our Grok 4.7 coverage covers the model itself.
• Weekly limits. Neither company publishes how much work weekly usage covers.
• A changelog. Cursor staff said on its forum that there is no official changelog yet. New features appear first on X.
• Enterprise timing. Access is “rolling out,” with no date.

Frequently Asked Questions