Back to Insights
AI Automation

Grok Bot Gives Each Agent Its Own Computer and Your Logins. Cheapest Seat Is $120 a Month.

SpaceXAI's Grok Bot puts always-on agents inside your apps by signing in as you. What it does, what it costs, and who should wait.

S5 Labs Team August 11, 2026

SpaceXAI put Grok Bot into beta on Tuesday, August 11, a product built jointly with Cursor. Each bot gets its own computer in the cloud and runs 24/7. In the company’s own description, the bots “sign into the tools you already use,” work across apps and inboxes, finish jobs end to end, and come back “only when something needs your approval.”

Grok Bot has no price of its own. It rides on plans you have to be on already, and the cheapest of those is Cursor Teams Premium at $120 per seat per month billed monthly — $96 on annual. The alternatives are Cursor Ultra at $200 a month or SuperGrok Heavy at $300. Enterprise access is a waitlist.

For a small business the price is the easy part of this decision. The phrase worth an hour of your attention is “sign into the tools you already use,” because it describes a mechanism, and the mechanism sets the blast radius.

What actually shipped

Grok Bot launched on Mac, iOS, Windows and Linux, with Android listed as coming. You talk to a bot the way you’d text a coworker. It keeps conversation history across tasks, learns your preferences, and can watch you complete a workflow once, then save it as a routine it runs on its own afterward.

The multi-agent piece goes further than most competing products. You can run several bots at once, put one bot in charge of others, let them message each other directly in threads, and drop them into group chats where they coordinate without you in the loop. SpaceXAI describes its own internal use: a sales bot updating the CRM from call transcripts and drafting follow-ups, an ops bot onboarding new hires and processing invoices out of Gmail, an engineering bot reproducing a UI bug, filing the ticket, then handing the fix to a separate debugging bot.

The line in the launch copy that operators should read twice is that bots work across apps and websites “including platforms with no clean API or MCP.” That is the differentiator and the architecture at once. Rather than integrating with your stack, Grok Bot operates it through the front door, holding a user account.

The difference between a login and a connector

When Anthropic shipped Claude for Small Business in May, the integrations into QuickBooks, HubSpot and Docusign were scoped connectors. Agent actions inherited each app’s existing permission model, and a human still clicked send. That design caps what an agent can do at whatever the OAuth grant allows, and it produces an audit trail inside the vendor’s own logs — attributed to a service identity you can revoke.

An agent that signs into a web app as you inherits something different. It gets your session, your roles, and every permission your account carries, in every app you handed it. There is no scope to narrow, because the credential is a person’s credential. Nothing in the target application distinguishes the bot’s actions from yours, so your CRM’s audit log and your inbox’s sent folder will attribute the work to you whether or not you were awake for it.

That same property is why the approach reaches the long tail of software that never shipped an API. The capability and the exposure come out of the same design decision, and you cannot buy one without the other.

The vendor you would be handing credentials to

Four weeks ago, Grok Build was caught uploading whole Git repositories to xAI storage, history and committed secrets included, regardless of what the agent had actually read. A researcher’s wire capture found a never-read canary file arriving intact after the agent was explicitly told not to open anything. xAI reframed the incident as a retention problem and disabled default retention in mid-July, then open-sourced the tool. It has still never addressed the claim that the repository went up whole.

That history belongs in the evaluation, because the same vendor is now asking for standing credentials to your CRM, your inbox and your accounting system. The lesson from July was that training consent, transmission consent and retention are three separate promises, and vendor privacy copy routinely collapses them into one toggle. Grok Bot widens the surface those questions cover. Repository contents are sensitive; a mailbox holding years of client correspondence and a ledger with your customers’ payment history sit in a different category.

In practice, this is the vendor-diligence line of your AI governance checklist: ask in writing what Grok Bot retains from the sessions it runs inside your applications, where the bot’s cloud computer stores intermediate state, and whether disabling retention stops transmission or only storage. Ask before you connect anything, and get the answer from a contract rather than a settings page.

The Hacker News thread on launch day was blunt about the same thing. One commenter asked whether readers were comfortable with “agents running non stop with access to all your accounts.” Another noted that at $120 to $200 per employee per month the pricing is defensible, and that plenty of companies still will not hand SpaceXAI their files.

What counts as “something that needs your approval”

xAI has not published what triggers the approval gate. One write-up of the launch says bots pause for financial transactions and external contracts. Assume that is directionally right. A great deal still happens underneath that gate without review: CRM fields the sales bot overwrites, follow-up emails it drafts and possibly sends, invoices the ops bot codes to an account.

Model reliability is one reason that gap matters. When Artificial Analysis measured Grok 4.5, the coding and agentic model SpaceXAI shipped in July, its hallucination rate came in at 54%, roughly double the prior generation’s, alongside real gains in knowledge and accuracy. A model that knows more and confabulates more often is a particular kind of risk when it holds write access and a mandate to finish end to end.

Prompt injection is the other. An agent processing your inbox is reading attacker-controlled text by definition. Anyone who can send you an email can put instructions in front of an agent that holds your session in every other application you connected. Browser-agent injections have been demonstrated repeatedly since Brave’s team hijacked Perplexity’s Comet with hidden text in a Reddit post in 2025, and giving the agent its own cloud computer changes none of that, only who is around to notice when one lands.

Most companies are not set up to notice. Gravitee’s State of AI Agent Security 2026 report, based on over 900 executives and practitioners, found 88% of organizations reported confirmed or suspected AI agent security incidents in the past year. Only 14.4% said all their agents went live with full security approval, and just 21.9% treat agents as identity-bearing entities rather than borrowers of someone else’s key. Grok Bot needs the controls that last group has built, and it is being sold to everyone else.

Who should pilot it, and who should wait

If you run a small team, already pay for Cursor Teams Premium, and have a repetitive workflow that lives in a tool with no API, this is worth a bounded pilot. The record-a-routine feature is the genuinely useful part for that shape of problem, and it targets the automation gap that Zapier and Make have never closed: the vendor with no integration and no webhook. Give one bot one account, scoped as tightly as the target application allows, on a workflow where a wrong action is annoying rather than expensive. Prospect research, meeting notes into the CRM, and invoice extraction qualify. Anything that sends client email or moves money does not.

Wait if you handle regulated data, if a single mistaken write to your system of record would be expensive to unwind, or if you cannot say where the bot’s data goes. Wait also if the only seat available to you is SuperGrok Heavy at $300 a month, because the beta is early enough that access itself was reportedly rough on launch day and Musk said a wider rollout was still coming.

The same trade turned up twice in one week. Meta’s coding agent charges 90% less if you let it keep your code. Grok Bot asks for something larger than data: the ability to act as you, in your applications, continuously. In neither case is money the main thing being asked for.

Grok Bot is a serious product, and the record-a-routine and multi-bot pieces are ahead of what most competitors ship. It also asks for a much broader grant of access than the connector-based products it competes with, from a company that spent July explaining why its coding agent uploaded repositories it had been told not to read. Settle that question on your own workflows before you get to whether the sales bot writes a decent follow-up.

Sources

Want to discuss this topic?

We'd love to hear about your specific challenges and how we might help.

Start a conversation