Grok Bot blocked by a site or CAPTCHA? What works

1Do the human step yourself with Take over

When a Bot meets a sign-in page, a code or a CAPTCHA, it stops and posts a Computer card that says what it needs. Click Take over, do that one step in the Bot's browser, then click I'm done, continue. The shared computer shows each screen.

• Wait for the signed-in page to load before you hand back.
• The login now sits on the computer, so every Bot on your account can use it until it expires.
• Fingerprint, Face ID and passkeys saved on your own devices don't work there. Use a password with a code, or an approval on your phone.

2Treat a Secure Form with care

A Bot can also ask with a smaller card: Sign in to and the site's name, with Secure Form under it. Open shows the site's fields inside the app, and the form types what you enter into the site's page.

The form carries the line "Never shown to your Bot". Don't rely on that line for a password that matters.

The form puts your password into the page and leaves the Bot to press the site's sign-in button. Until the page moves on, the password is sitting in the page the Bot reads, and from there it can end up in the Bot's record of the task.

• For an account that matters: tell the Bot to skip the sign-in and leave the page open. Then open the Bot's screen, type the password on the site's own page and press the site's sign-in button yourself. Once the page has moved past the sign-in form, the password is no longer on it.
• If you've already used the form for one: change that password.

3Route the Bot's browsing through your own computer

A site that keeps blocking or re-checking the Bot after you've done the human step distrusts the data-center connection. One setting sends the Bot's web traffic out through the desktop you're using, so sites see your own connection.

In the desktop app, open Settings > Computer. Under Network, turn on Route traffic through this computer.

• The route covers the Bot's browser and nothing else on its computer.
• It applies to new connections, so ask the Bot to open the site in a new tab.
• The setting belongs to this one desktop. The Bot's browser reaches what this desktop can reach, and nothing this desktop can't. If every page on the Bot's computer starts timing out, check your own connection and any VPN, or turn the switch off.
• On an Enterprise team an admin can lock the switch. It then reads "Disabled by your admin. You can't turn this on."

A site can still show a CAPTCHA. Do it yourself, as in the first step.

4Use a plugin where the app has one

A plugin connects a Bot to a service without the service's website. You approve it once in your own browser, and the Bot never loads the sign-in page from the data center. Where a plugin exists, it's often the more reliable route.

To check, click Connect apps at the bottom of the sidebar and type the app's name in Search across apps and skills.

• Gmail, Google Calendar, Outlook, Slack, Notion and GitHub each have a plugin. Plugins covers adding one and signing it in.
• Some services with no plugin issue an access token for automated use. Create one in the service's settings. When the Bot asks for it, enter it in the card with Save securely, never in a chat message.