Grok Bot

Lesson 4

The Grok Bot computer is shared — not a security boundary

This is the page you must not skip. Official computer docs: every Bot under the account uses the same persistent cloud computer; browser cookies and login state are shared, files are visible to each other, shell credentials are shared, and progress written by one Bot can be continued by another. The computer is assigned to the user, not to a single Bot. If you do not want another Bot to touch a credential or file, do not put it on this computer.

Each Bot has its own screen on that computer, so they can use the browser and desktop tools in parallel — but one screen runs one computer-use task at a time. Screens are a work surface, not a security boundary. The Cursor forum thread Bots are not a security boundary put that consensus in the title. Some internal writers said “own computer” when they meant “own screen”; xAI docs correct the loose wording.

How you watch and take over

Open Agent Computer from the chat; the preview shows clicks, typing, and current state. Close Grok Bot or shut the laptop and cloud work keeps going. For passwords, passkeys, 2FA, CAPTCHAs, payments, or sites that insist on a human, the Bot should hand the computer to you: open the computer, take over, finish only the stuck step, return control, and let it continue. Do not paste passwords or one-time codes into ordinary chat. When a supported connector shows a secrets card, fill it there — values are masked, stay out of the conversation, and are not shown to the model.

Sessions usually persist, so you need not re-login for every task. Because the browser is shared, logging one Bot in opens the door for everyone on the roster. Some sites expire, time out quickly, or re-verify — have the Bot stop and notify you instead of bypassing checks.

The workspace survives updates; packages may not

The shared workspace is /workspace. Have Bots keep project files there and organize by project folder. Files, browser state, and supported logins are designed to survive ordinary computer updates and recovery. Temp directories, manually installed packages, and uncommitted app state should be treated as disposable. Staff also note: Update Computer keeps files and logins but rebuilds the OS image, so apt/apps/daemons disappear; idle machines sleep and background processes die. Keep a software list in a file and have the Bot reinstall after updates.

Recovery order (official troubleshooting, least destructive first): Retry → restart the app → Recover computer (when offered) → Settings → Beta → Update Agent Computer → Reset only if you accept losing unsynced work. Recover / Update keep durable files and logins; Reset returns to the latest snapshot. Chat history lives outside the box; Reset is last resort. Details: troubleshooting.

Local computer is a different permission surface

The cloud computer is not the Mac/Windows in front of you. Only when Settings → General → Agent → Execution on Local Computer is on and you approve does a Bot run commands locally. Default is ask every time. Keep Never allowed unless you have a clear reason. Staff also note: a Grok Bot login counts as a Cursor device, and the cloud workspace may count as another — that can hit Too many computers.

Common misconceptions

  • Using “life Bot / work Bot” as isolation. They see the same logins.
  • Pasting API keys into chat. Use the secrets card; see Store secrets securely.
  • Resetting when the computer is briefly unreachable. Prefer Recover / Update. When the desktop is black but iOS still works, Reset can delete Bots — wait for an official rebuild.
  • Treating WhatsApp linked-device sessions as durable state. Refresh keeps /workspace, browser profile, and ~/.config, but not ~/.local/state.

Once computer use is stable, save “done right once” — skills first, then routines.