# Is Grok Bot safe? Logins, data and what to connect first

A Bot acts as you on every account you sign it in to, and all your Bots share those logins. See what to connect first, what to leave out and how data is used.

*From Learn Grok Bot, an independent guide (not affiliated with SpaceXAI or Cursor). Web version: https://learngrokbot.com/safety Last verified: 2026-10-06.*

Grok Bot is safe to start with if you choose what it can reach. A Bot acts as you on any account you sign it in to, and all your Bots share those logins. Begin with accounts where a mistake is cheap.

**In short**

- A Bot has no identity of its own. On an account it's signed in to, it acts as you.
- All your Bots share one computer, so a login you give one Bot is a login you give all of them.
- Start with reading and drafting. Put an **Ask first** rule on sending, posting and paying. Keep bank logins, and accounts that aren't only yours, off the Bot's computer.
- Type passwords on the site's own page yourself. A password typed into the app's sign-in form has been readable by the Bot.
- Training follows the privacy setting on your Cursor account, and the Bot's computer runs in the United States.

## Sort your accounts onto the risk ladder

The accounts people connect fall onto three rungs, by what a Bot could do there in your name. Tap the ones you have in mind.

**Interactive: Where does each account land?**

Open it: https://learngrokbot.com/widgets/safety-risk-ladder.html

What it does: Tap the accounts you're thinking of giving a Bot (email, a calendar, Slack, X, shopping, your bank's website, LinkedIn, an account that isn't only yours, files on your own computer, or plain public websites). Each lands on one of three rungs, fine in week one, connect with Ask first, or keep away, with the reason and, where one is needed, the rule to add.

Its content as text:

### Where does each account land?

Tap the accounts you're thinking of giving a Bot. Each lands on one of three rungs, with the reason.

Here are ten accounts people connect, each on its rung.

1. **Fine in week one**
   A Bot only reads here, or nothing of yours is signed in.
   **Public websites, with no login**
   No login
   Research on public pages needs no account of yours, so there's nothing for a Bot to act on in your name. Start here.
   **Your calendar, through the Google Calendar plugin**
   Plugin
   Begin with jobs that read your day. The plugin can also create events and answer invitations, so add an **Ask first** rule before you let a Bot invite anyone.
2. **Connect with Ask first**
   A Bot can send, post or pay here in your name. Connect it, and [add a rule](https://learngrokbot.com/approvals#write-a-rule) so it asks before the step that can't be taken back.
   **Email, through the Gmail or Outlook plugin**
   Plugin
   The Gmail plugin can read, draft and send, and a sent email can't be called back. A Bot's emails arrive as drafts with **Send email** and **Discard**. Leave drafts on, and add the rule as a second check.
   **Rule** `send an email`
   **Slack, through the Slack plugin**
   Plugin
   The plugin posts as you, in any channel you can post in. A Bot's messages arrive as drafts with **Send message** and **Discard**.
   **Rule** `post a message in Slack`
   **Your X account, through the X plugin**
   Plugin
   A post is public the moment it goes out, under your name.
   **Rule** `post, reply or repost on X`
   **Shopping and payments, through Link**
   Plugin, US only
   A Bot can pay with a card saved in your Link wallet. Each purchase comes to you first as a card that shows the amount, and a request you decline or leave to expire makes no charge.
   **Rule** `buy or pay for anything`
3. **Keep away**
   The whole account would sit within reach of every Bot you have, or the site may turn a Bot away. Leave it off the Bot's computer.
   **Your bank's website**
   Browser login
   Signing in on the Bot's browser puts the whole account within reach of every Bot you have, acting as you. Grok Bot's terms make you responsible for whatever a Bot does there.
   **LinkedIn, signed in on the Bot's browser**
   Browser login
   LinkedIn has no plugin, so a Bot would work through your own login from a cloud computer. Whether a site allows a Bot at all is in that site's terms, and following them is your job.
   **An account that isn't only yours**
   Any login
   A client's login, an employer's or a family account. Every Bot on your account can use a login on the computer, and a teammate's Team Bot usually can too while you chat with it. Work that needs logins of its own needs a Cursor account of its own.
   **The files on your own Mac or PC**
   Your computer
   Your computer is separate from the Bot's computer in the cloud. [Execution on this computer](https://learngrokbot.com/approvals#own-computer) decides whether Bots may open files and run tasks there. Set it to **Never allow** until a job needs your local files.

The rungs follow one idea. Reading and drafting are easy to check. Sending, posting and paying can't be taken back, so they wait for your answer.

## What a Bot can do once it has a login

A Bot has no account or password of its own. Once a site is signed in on the Bot's computer, a Bot works there as you, and the site's own records show your name.

The login doesn't belong to the Bot you were talking to. It sits on the one computer all your Bots work on.

Diagram: You sign in to a site once. The login sits on the one cloud computer. Your Research Bot and your Inbox Bot can both use it, and so can a Bot you add next month. The site sees each of them as you.
- You → One login, on the computer: you sign in once
- Research → One login, on the computer
- Inbox → One login, on the computer
- A Bot you add later → One login, on the computer
- Note on One login, on the computer: the site sees you
- Note on Inbox: every Bot can use it

- A plugin works the same way. Once it's installed, every Bot on your account can use it.
- A Bot can do on a site whatever your login can do there.
- The login lasts until it expires or you sign out on the Bot's computer. Deleting the Bot that used it doesn't remove it.

[The shared computer](https://learngrokbot.com/shared-computer#whats-shared) shows what else your Bots share.

## Keep passwords and codes in your own hands

When a site wants a password, a sign-in code or a CAPTCHA, a Bot stops and hands the step to you. It either gives you its screen or shows a **Secure Form** inside the app.

The form carries the line **Never shown to your Bot**. Don't rely on that line yet. A password typed into the form has turned up, readable, in the copy of the page a Bot takes before it clicks the sign-in button. Cursor has confirmed the fault and is working on a fix.

![The Secure Form dialog for signing in to GitHub. It has a Username or email address field, a Password field, a line that reads Never shown to your Bot. Filled directly to github.com. and a Continue button](https://learngrokbot.com/assets/shots/safety-secure-form.png)

Until the fix is out, sign in on the Bot's screen:

1. Open the Bot's computer, or click **Take over** when the Bot offers it. [The shared computer](https://learngrokbot.com/shared-computer#take-over) has both.
2. Type the password on the site's own page, and click the site's sign-in button yourself.
3. Hand the computer back once the page has moved past the sign-in form. The password is then no longer on the page for the Bot to read.

A password you've already typed into a Secure Form is worth changing. And a password or a one-time code never goes into the chat, where it becomes part of the conversation.

## Six habits for a careful first week

The ladder says which accounts to connect. These six habits are how you connect them, each with the damage it limits.

| Habit | What it limits |
|---|---|
| **One plugin for one job** | A Bot can only misuse what's connected. Add the next plugin when the first job runs the way you want. |
| **Read and draft first** | A summary or a draft that's wrong costs you a minute. Hand over the sending once the drafts are right. |
| **Ask first on what can't be undone** | Sending, posting, paying and deleting wait for your answer. [Approvals](https://learngrokbot.com/approvals#write-a-rule) has the steps. |
| **Allow once on anything that matters** | On a card that touches an account, money or something shared, **Allow once** covers that one action. **Always allow** can save a rule that covers actions like it. |
| **A separate account for separate work** | Bots on one account share everything on its computer. Work that needs logins of its own needs a Cursor account of its own. |
| **Clean up when a job ends** | Pause or delete its routines, sign out of its sites on the Bot's computer, remove the plugin and revoke its access in the app it connected to. |

## How your data is used

What a Bot reads and makes is stored and processed in the cloud. This is where it goes and what you control.

| Question | Answer |
|---|---|
| Is my data used to train models? | That follows the privacy setting on your Cursor account. With Privacy Mode on, your data isn't used for training. On a team, the team's setting applies to you. |
| Do the model providers keep it? | No. Under Cursor's agreements, providers keep no prompts and no outputs. They can run abuse and safety checks, and data those checks flag may be stored for investigation. |
| Where does the computer run? | In the United States, on Cursor's cloud. There's no choice of region. |
| Can other users reach my computer? | No. Each user's computer is its own virtual machine, separated from other users' at the hardware level. |
| What stays on the computer? | Files, website logins and anything saved in the browser, kept on disk between sessions. An idle computer hibernates, which deletes nothing. |
| Is it encrypted? | Yes, in transit and at rest. |
| What does deleting a Bot remove? | The Bot. Its files and its logins stay on the computer until you remove them. |
| How do I delete everything? | Delete your Cursor account. Your Bots, chats, computer and connected plugins go with it, and all data is removed within 30 days. |

Grok Bot has to store data to work, so it won't run on a Cursor account set to Privacy Mode (Legacy). [Sign-in and linking](https://learngrokbot.com/sign-in-and-linking#legacy) has the fix.

## Check: get a Bot into a site

You'll meet this decision the first time a site asks a Bot for a password. Try it here first.

**Quick check: A Bot needs to get into a site that asks for your password. Which way is safest?**

- Paste the password into the chat
- Type it into the Secure Form the Bot sends
- Open the Bot's screen, type it on the site's own page and click the site's sign-in button yourself
- Ask the Bot to remember it for next time

Answer: Open the Bot's screen, type it on the site's own page and click the site's sign-in button yourself Once the page has moved past the sign-in form, the password is no longer there for the Bot to read.

## Questions people ask

### Can a web page or an email trick a Bot?

Yes, it can try. Anything a Bot reads from outside, such as a web page, an email or a file, can carry instructions aimed at the Bot. Grok Bot marks outside content as untrusted, and with Auto-review on, a Bot's actions are checked against what you asked for. That lowers the risk without removing it. With sending, posting and paying behind **Ask first**, a Bot that has been tricked still has to get past you.

### If a Bot gets something wrong, who is responsible?

You are. Grok Bot's terms make you responsible for every action a Bot takes on your behalf, whether you intended it or not. The same terms describe approvals and Auto-review as aids that may not catch every harmful action and that don't reverse one that's done.

### Who makes Grok Bot?

SpaceXAI announces and documents it, and it runs on Cursor: you sign in with a Cursor account, and Cursor hosts the computers and handles billing. Cursor is part of SpaceX. The company behind Cursor holds ISO/IEC 27001 and ISO/IEC 42001 certificates, and Grok Bot is in their scope.

### How do I stop a Bot that's doing the wrong thing?

Send it "Stop now". The Bot stops, and so do any Bots it handed work to. Stopping doesn't undo what's already done.

### Is it safe to add a Bot from someone else's template?

A template brings its own instructions, memories, skills and routines, and the new Bot works on your computer, with every login and plugin that's there. Read what it carries in the review window before you click **Add Bot**.

The next step is the rule itself.

**Next:** [Set your first Ask first rule](https://learngrokbot.com/approvals)

See what a Bot does without asking, answer an approval card, and write the rule that makes it stop.

- 2026-10-06: First published.

## Sources

- [SpaceXAI docs: Grok Bot security](https://docs.x.ai/grok-bot/security)
- [SpaceXAI docs: Grok Bot security FAQ](https://docs.x.ai/grok-bot/security-faq)
- [SpaceXAI docs: Approvals, security, and privacy](https://docs.x.ai/grok-bot/approvals-security-and-privacy)
- [SpaceXAI docs: Grok Bot for teams and enterprises](https://docs.x.ai/grok-bot/teams-and-enterprises)
- [SpaceXAI docs: Use the computer and apps](https://docs.x.ai/grok-bot/computer-and-apps)
- [SpaceXAI docs: Create and manage Bots](https://docs.x.ai/grok-bot/bots)
- [SpaceXAI docs: Chat and collaboration](https://docs.x.ai/grok-bot/chat-and-collaboration)
- [SpaceXAI: Grok Bot Terms](https://x.ai/legal/grok-bot-terms)
- [Cursor Help Center: Privacy and data](https://cursor.com/help/security-and-privacy/privacy)
- [Cursor: Data Use](https://cursor.com/data-use)
- [Cursor Help Center: Grok Bot How Tos](https://cursor.com/help/grok-bot/how-to)
- [Cursor Help Center: Connect plugins](https://cursor.com/help/grok-bot/connect-plugins)
- [Cursor Help Center: Delete your Grok Bot account](https://cursor.com/help/grok-bot/delete-account)
- [SpaceXAI: Grok Bot product page](https://x.ai/bot)
- [SpaceXAI: Grok Bot changelog](https://x.ai/changelog/bot)
- [Grok Bot on X: the Finance plugin is read-only, through Plaid](https://x.com/bot/status/2103936249832903074)
- [Cursor forum: staff on a password filled by the Secure Form](https://forum.cursor.com/t/grok-bot-browser-snapshot-shows-a-password-filled-by-the-secure-form-requestuserform-in-plain-text/173748)
- [r/GrokBot: a LinkedIn session revoked after a Bot sent messages](https://www.reddit.com/r/GrokBot/comments/1wp291u/)
- [VelvetShark: Grok Bot after 67 real jobs](https://velvetshark.com/grok-bot-after-67-real-jobs)