Is Grok Bot safe? Logins, data and what to connect first

Grok Bot is safe to start with if you choose what it can reach. A Bot acts as you on any account you sign it in to, and all your Bots share those logins. Begin with accounts where a mistake is cheap.

#Sort your accounts onto the risk ladder

The accounts people connect fall onto three rungs, by what a Bot could do there in your name. Tap the ones you have in mind.

Where does each account land?

Tap the accounts you're thinking of giving a Bot. Each lands on one of three rungs, with the reason.

Here are ten accounts people connect, each on its rung.

Tap one to place it on the ladder.

Fine in week one

A Bot only reads here, or nothing of yours is signed in.

Nothing on this rung yet.

Public websites, with no login
No login
Research on public pages needs no account of yours, so there's nothing for a Bot to act on in your name. Start here.

Your calendar, through the Google Calendar plugin
Plugin
Begin with jobs that read your day. The plugin can also create events and answer invitations, so add an Ask first rule before you let a Bot invite anyone.
Connect with Ask first

A Bot can send, post or pay here in your name. Connect it, and add a rule so it asks before the step that can't be taken back.

Nothing on this rung yet.

Email, through the Gmail or Outlook plugin
Plugin
The Gmail plugin can read, draft and send, and a sent email can't be called back. A Bot's emails arrive as drafts with Send email and Discard. Leave drafts on, and add the rule as a second check.

Rule send an email

Slack, through the Slack plugin
Plugin
The plugin posts as you, in any channel you can post in. A Bot's messages arrive as drafts with Send message and Discard.

Rule post a message in Slack

Your X account, through the X plugin
Plugin
A post is public the moment it goes out, under your name.

Rule post, reply or repost on X

Shopping and payments, through Link
Plugin, US only
A Bot can pay with a card saved in your Link wallet. Each purchase comes to you first as a card that shows the amount, and a request you decline or leave to expire makes no charge.

Rule buy or pay for anything
Keep away

The whole account would sit within reach of every Bot you have, or the site may turn a Bot away. Leave it off the Bot's computer.

Nothing on this rung yet.

Your bank's website
Browser login
Signing in on the Bot's browser puts the whole account within reach of every Bot you have, acting as you. Grok Bot's terms make you responsible for whatever a Bot does there.

LinkedIn, signed in on the Bot's browser
Browser login
LinkedIn has no plugin, so a Bot would work through your own login from a cloud computer. Whether a site allows a Bot at all is in that site's terms, and following them is your job.

An account that isn't only yours
Any login
A client's login, an employer's or a family account. Every Bot on your account can use a login on the computer, and a teammate's Team Bot usually can too while you chat with it. Work that needs logins of its own needs a Cursor account of its own.

The files on your own Mac or PC
Your computer
Your computer is separate from the Bot's computer in the cloud. Execution on this computer decides whether Bots may open files and run tasks there. Set it to Never allow until a job needs your local files.

Open on its own page

The rungs follow one idea. Reading and drafting are easy to check. Sending, posting and paying can't be taken back, so they wait for your answer.

A Bot has no account or password of its own. Once a site is signed in on the Bot's computer, a Bot works there as you, and the site's own records show your name.

The login doesn't belong to the Bot you were talking to. It sits on the one computer all your Bots work on.

A plugin works the same way. Once it's installed, every Bot on your account can use it.
A Bot can do on a site whatever your login can do there.
The login lasts until it expires or you sign out on the Bot's computer. Deleting the Bot that used it doesn't remove it.

The shared computer shows what else your Bots share.

#Keep passwords and codes in your own hands

When a site wants a password, a sign-in code or a CAPTCHA, a Bot stops and hands the step to you. It either gives you its screen or shows a Secure Form inside the app.

The form carries the line Never shown to your Bot. Don't rely on that line yet. A password typed into the form has turned up, readable, in the copy of the page a Bot takes before it clicks the sign-in button. Cursor has confirmed the fault and is working on a fix.

The Secure Form dialog for signing in to GitHub. It has a Username or email address field, a Password field, a line that reads Never shown to your Bot. Filled directly to github.com. and a Continue button

Until the fix is out, sign in on the Bot's screen:

Open the Bot's computer, or click Take over when the Bot offers it. The shared computer has both.
Type the password on the site's own page, and click the site's sign-in button yourself.
Hand the computer back once the page has moved past the sign-in form. The password is then no longer on the page for the Bot to read.

A password you've already typed into a Secure Form is worth changing. And a password or a one-time code never goes into the chat, where it becomes part of the conversation.

#Six habits for a careful first week

The ladder says which accounts to connect. These six habits are how you connect them, each with the damage it limits.

Habit	What it limits
One plugin for one job	A Bot can only misuse what's connected. Add the next plugin when the first job runs the way you want.
Read and draft first	A summary or a draft that's wrong costs you a minute. Hand over the sending once the drafts are right.
Ask first on what can't be undone	Sending, posting, paying and deleting wait for your answer. Approvals has the steps.
Allow once on anything that matters	On a card that touches an account, money or something shared, Allow once covers that one action. Always allow can save a rule that covers actions like it.
A separate account for separate work	Bots on one account share everything on its computer. Work that needs logins of its own needs a Cursor account of its own.
Clean up when a job ends	Pause or delete its routines, sign out of its sites on the Bot's computer, remove the plugin and revoke its access in the app it connected to.

#How your data is used

What a Bot reads and makes is stored and processed in the cloud. This is where it goes and what you control.

Question	Answer
Is my data used to train models?	That follows the privacy setting on your Cursor account. With Privacy Mode on, your data isn't used for training. On a team, the team's setting applies to you.
Do the model providers keep it?	No. Under Cursor's agreements, providers keep no prompts and no outputs. They can run abuse and safety checks, and data those checks flag may be stored for investigation.
Where does the computer run?	In the United States, on Cursor's cloud. There's no choice of region.
Can other users reach my computer?	No. Each user's computer is its own virtual machine, separated from other users' at the hardware level.
What stays on the computer?	Files, website logins and anything saved in the browser, kept on disk between sessions. An idle computer hibernates, which deletes nothing.
Is it encrypted?	Yes, in transit and at rest.
What does deleting a Bot remove?	The Bot. Its files and its logins stay on the computer until you remove them.
How do I delete everything?	Delete your Cursor account. Your Bots, chats, computer and connected plugins go with it, and all data is removed within 30 days.

Grok Bot has to store data to work, so it won't run on a Cursor account set to Privacy Mode (Legacy). Sign-in and linking has the fix.

#Check: get a Bot into a site

You'll meet this decision the first time a site asks a Bot for a password. Try it here first.

Quick check

A Bot needs to get into a site that asks for your password. Which way is safest?

Paste the password into the chatA message becomes part of the conversation, and the Bot reads every word of it.
Type it into the Secure Form the Bot sendsThe form says the Bot never sees it, but a password typed there has been readable by the Bot afterwards. A fix is on the way.
Open the Bot's screen, type it on the site's own page and click the site's sign-in button yourselfOnce the page has moved past the sign-in form, the password is no longer there for the Bot to read.
Ask the Bot to remember it for next timeA Bot's memory is for preferences and facts about your work. A password saved there is a password the Bot holds.

Show the answer

Open the Bot's screen, type it on the site's own page and click the site's sign-in button yourself Once the page has moved past the sign-in form, the password is no longer there for the Bot to read.

#Questions people ask

Can a web page or an email trick a Bot?

Yes, it can try. Anything a Bot reads from outside, such as a web page, an email or a file, can carry instructions aimed at the Bot. Grok Bot marks outside content as untrusted, and with Auto-review on, a Bot's actions are checked against what you asked for. That lowers the risk without removing it. With sending, posting and paying behind Ask first, a Bot that has been tricked still has to get past you.

If a Bot gets something wrong, who is responsible?

You are. Grok Bot's terms make you responsible for every action a Bot takes on your behalf, whether you intended it or not. The same terms describe approvals and Auto-review as aids that may not catch every harmful action and that don't reverse one that's done.

Who makes Grok Bot?

SpaceXAI announces and documents it, and it runs on Cursor: you sign in with a Cursor account, and Cursor hosts the computers and handles billing. Cursor is part of SpaceX. The company behind Cursor holds ISO/IEC 27001 and ISO/IEC 42001 certificates, and Grok Bot is in their scope.

How do I stop a Bot that's doing the wrong thing?

Send it "Stop now". The Bot stops, and so do any Bots it handed work to. Stopping doesn't undo what's already done.

Is it safe to add a Bot from someone else's template?

A template brings its own instructions, memories, skills and routines, and the new Bot works on your computer, with every login and plugin that's there. Read what it carries in the review window before you click Add Bot.

The next step is the rule itself.

ThenSet your first Ask first rule

See what a Bot does without asking, answer an approval card, and write the rule that makes it stop.

6 October 2026
First published.

#Sort your accounts onto the risk ladder

Fine in week one

Public websites, with no login

Your calendar, through the Google Calendar plugin

Connect with Ask first

Email, through the Gmail or Outlook plugin

Slack, through the Slack plugin

Your X account, through the X plugin

Shopping and payments, through Link

Keep away

Your bank's website

LinkedIn, signed in on the Bot's browser

An account that isn't only yours

The files on your own Mac or PC

#What a Bot can do once it has a login