xAI launches Grok Bot: AI colleagues with their own computers who use your accounts to get work done
- xAI's Grok Bot gives each AI colleague an always-on cloud computer that clicks through websites using your logged-in session.
- That means it can work even on sites without open APIs. When it hits a login, CAPTCHA, or payment, it hands the computer back to you.
- A permission rule you write in plain language keeps it in check, with a separate reviewer agent double-checking each action.
Personal agents used to spend all their time on upkeep
On August 11, xAI (Musk’s AI company) released an early beta of Grok Bot, which it describes as a new kind of colleague. Each one lives on a persistent Linux machine in the cloud, using your logged-in session to browse the web, open apps, and read or write files, just like a person would. It only comes back to you when it’s done. As a result, it can operate sites that don’t offer APIs.
The big trend this year: setting up a “personal AI assistant” at home—plugging in a Mac mini, leaving it on 24/7, hooking it up to iMessage, and sending it tasks by text.
The hottest open-source project on that path is OpenClaw: 386k stars on GitHub, the 6th most-starred repo on the entire platform (checked August 12). The five ahead of it are all learning-resource lists and book roundups.
Grok Bot does the same thing, except you don’t have to maintain the machine yourself. It runs on the vendor’s cloud, always on. You still send it a message to assign a task.
It’s also not some cloud-hosted version of a coding agent like Claude Code. For actual coding work, it outsources the job to Cursor’s cloud agents.
One relationship worth clarifying upfront: SpaceX folded in xAI back in February and announced a $60B stock deal to acquire Cursor in June. The two product lines are now intertwined — which is why Grok Bot’s subscription tier is called “Cursor Ultra.”
Grok Bot targets exactly what Pauls complained about:
So far, every “personal agent” feels the same: configuring, provisioning, tasking, triaging — just never doing anything useful.
I spend more time debugging broken deployments and ignoring the weekly iMessage check-in than I do using the tools that were supposed to make life easier.
Matt Pauls
Getting an AI to work for you used to mean provisioning a remote server, creating service accounts, loading API keys, and monitoring weekly to make sure it hadn't crashed. These chores eat the very time you were trying to save.
What he wanted was simple: an agent that could do the same things he does manually on his own computer — no remote server to configure, no service accounts to manage, no extra security risk to take on.
Grok Bot’s answer: a cloud computer for every bot
Every Grok Bot gets its own computer. Since it lives in the cloud, it's always awake — you can close your laptop and walk away, and its tasks keep running. It does everything you can do on your own machine: browse the web, open apps, read and write files, take screenshots.
Under the hood, it’s a persistent Linux VM; the feel is closer to a very fast, always-on remote desktop. Every bot you create lives there.
/workspace directory (11 folders, 30 files, 42.8 MB, with names like tech-demos, writing, and paintings), a terminal beside it showing the prompt box@cursor, and Chrome sitting in the dock below. The “Teach a task” button in the top right is the “watch and learn” feature covered later.All bots you create share this machine’s files, browser, and login state. Log in to a site once, and any of your bots can use that session until it naturally expires. When you chat with it from the desktop app, it can also read files on your local machine.
How it looks on mobile makes the intended usage crystal clear: a conversation list that feels like iMessage, bots grouped by project, each avatar a colored dot, and tapping in opens a chat.
So Grok Bot works even on sites without APIs
Previously, to have a program operate a service for you, the company behind it had to offer an API or MCP. That choice was theirs: big companies often did, smaller ones didn’t; new systems did, but that ten-year-old internal backend never would. You could wait, or give up, on automating it.
Giving an agent a computer changes that premise. It faces the same page in a browser as you do, and the test becomes simple: Can a human click this? If yes, it can click it for you.
Automation depends on whether the vendor offers an API. For everything without one—internal dashboards, legacy systems, sites with no developer docs— that’s the end of the road.
Automation depends on whether a human can click the page. If it opens in a browser, the agent can get through.
The launch notes put it even more plainly: bots can work across apps, tools, and websites, including platforms with neither a clean API nor MCP. The scope of what can be automated has shifted from “services with open APIs” to “anything a browser can open.”
But login and payment will stop it — Grok Bot hands the computer back
Working through a screen means anything designed to block machines will block it too: logins, single sign-on, two-factor authentication, CAPTCHAs, payment confirmations.
When it hits one of these, it hands the computer back to you. You get past that gate manually, then hand the machine back, and it picks up where it left off.
You don't have to wait until it's stuck to see what it's doing: the desktop app keeps a live view of the cloud computer's screen on the side, so you can see at a glance which page it has open or what step it's on.
This hurdle only needs to be cleared once. After that, the session stays on the cloud machine, and all your bots can use it until it naturally expires — no need to log in separately for each bot.
After you enter your username and password on a site, your browser stores a credential that says “I’ve already logged in.” It’s why you don’t have to re-enter your password on every page.
Think of it like a visitor badge you get at an office: it gets you in, it has an expiration date, and when it lapses, you get a new one.
Simpler credentials don’t require all this. For plain-text stuff like API keys, the bot sends you a secure form to fill out. That’s how MCP configurations and various secrets are handled.
Grok Bot watches you do it once, then saves it as a routine
To teach it a repetitive task, let it watch you do it once. It records the steps, saves them as a routine, and runs them on its own next time.
A saved sequence: what to do, in what order, and when to start.
Like a shortcut on your phone, except you don’t have to assemble the blocks — just demonstrate it once.
Routines can run on a schedule or be triggered by external events — a new message in Slack, a new commit on Git. You can let the bot build the trigger itself or fine-tune it by hand.
The instruction field is a paragraph; triggers are picked from a menu — no expression syntax required. To change what it does, you edit that paragraph.
Desktop shows a panel listing all your routines, each with its schedule — a morning brief at 8 a.m., an inbox clean-up at 6 p.m. on weekdays, and so on. If you don't want one running for a while, pause it; the panel marks it "Paused."
Memory has three layers, and bots can assign work to each other
What it remembers splits into three distinct layers:
The agent-layer profile acts as the bot’s top-level config — who it is, what it’s responsible for, what rules it works by. With all three layers in play, chat stays fast — surprisingly so.
Bots aren't solitary workers either. They can message and trigger each other, collaborate in the same group chat or project, or have one master bot coordinate the rest. Inside xAI, a common setup is a "chief of staff" at the top with a specialist underneath for each track — inbox, expenses, recruiting, bug fixes, and ops.
Coding tasks get handed off directly to Cursor
Since the two companies are one, a bot can spin up a Cursor cloud agent to write code. The finished PR card appears right in the chat feed — files changed, lines added and removed — with one button to open it on GitHub and another to open it in Cursor.
cursor/img2threejs-playground-mvp-3041, PR #1, 23 files changed, +1425 / -2 lines. The summary above also notes that the reference image was swapped for a real photo and where the model reconstruction was saved.The GitHub connector is easy to set up, and once it’s configured, the bot can run gh commands on the command line and create new repos.
It connects to other things in a familiar way: plugins, connectors, and skill packs are shared with Cursor, so basic connectors work out of the box — Notion, Slack, GitHub, plus any MCP services your team has built. Context sources already configured in Cursor carry over at no cost.
So the thing keeping Grok Bot in check is a paragraph of plain English
An agent with a computer and your login — will it actually do what you ask? And how would you know?
If you let an agent with a computer log into your Amazon account, it can technically buy anything it wants, exactly like a person could.
Matt Pauls
Three things work togetherher to keep it in line: permissions, a reviewer agent, and allow/deny lists.
Another AI dedicated to oversight. Before the working bot takes an action, the reviewer checks it against the rules you wrote, then decides: allow, block, or ask you.
Like an expense approver at a company — the worker submits the form, the approver checks it against policy, and escalates anything above a threshold.
Rules live in the Agent section of the settings, written in natural language. The allow/deny lists guide the reviewer. All of this happens inside an isolated environment.
Your rule says “Ask me first for anything user-facing,” so this one stops for your confirmation. This exact rule appears in the screenshot above.
The allow-list already permits this Slack search tool, so it goes through automatically. That’s the first rule in the screenshot above.
For actions not covered by lists, the reviewer judges on the fly based on your rules, and the result is allow, block, or ask. This panel is this site’s illustration based on the official description; the original text doesn’t give the specific example of placing an order.
Most people are used to setting agent rules with code or JSON. Here, the rule is essentially a prompt. Whether the sentence you write works depends on whether another model chooses to follow it.
This design initially felt unsettling. But after several weeks of use, no overstepping occurred. There was also the line, “Recent research suggests we should trust agents more than ourselves at this point,” though no source was cited.
So Matt Pauls ran four bots himself
People are already using it for things like: negotiating with vendors in your own voice (meaning your writing style, not a voice clone), triaging support tickets for your own store, and keeping your CRM up to date.
The official list includes eight roles: sales outreach, recruiting, ads, expenses, product data, bug reproduction, customer health, plus a chief of staff overseeing the rest.
Matt Pauls ran these four, each on its own schedule:
| Bot | Schedule | What it does | What it brings back |
|---|---|---|---|
| Demo Bot | Daily | Goes through X bookmarks to pick a new tech (an npm package or agent skill pack)Starts a prompt with his writing skill for review, then spins up a Cursor cloud agent in the tech-demos repo once approved | A runnable prototype in Cursor 15 minutes later |
| Content Bot | Hourly | Scans engineering and product Slack channels for small updates | Opens a new session to remind him, with a suggested post; connected to Typefully for one-click draft publishing |
| Product Bot | Daily | Watches the bigger announcement channels, slower and more thorough | A summary, so he doesn’t have to dig through Slack |
| Grocery Bot | Fridays | Checks Instacart and Amazon simultaneously — compares items, quantities, and prices, manages both carts, and factors in delivery fees | A reminder to place the order; Saturday delivery |
| DoorDash Bot | When a drd.sh link appears in Slack | Watches group orders; can pull a specific restaurant’s menu | A few options with real prices + a link to join the order |
Demo Bot: removing all friction from “try something new”
This is his favorite, because it fixes a specific laziness: see an interesting tool, bookmark it, never open it again. Demo Bot sorts through his bookmarks daily, picks one, and turns it directly into something runnable.
Every agent records its screen to prove what it did. No need to read through logs — just watch the replay to see if anything went off the rails.
Grocery Bot: it made a judgment call instead of forcing a substitution
He doesn’t hate grocery shopping; he hates the delivery interfaces. This bot compares items and prices across Instacart and Amazon, manages both carts, and includes delivery fees.
Fresh blackberries were out of stock at that Costco, so it didn’t put them in the cart, didn’t silently swap in frozen ones — it reported the gap. Whether to substitute is a judgment call, and it chose transparency.
DoorDash Bot: it left the final step to a human
His team often opens DoorDash group orders in Slack, and he’s both new to DoorDash and prone to spiraling over decisions like “chicken rice bowl vs. chicken with a side of rice.” This bot watches for group-order links in Slack and alerts him when there’s one.
It didn’t place the order:
The cart is still open and auto-orders at 5 p.m. I haven’t joined or added anything. Tell me which one, and I’ll do it.
DoorDash Bot’s report
It pulled the menu, listed prices, made its recommendation, then stopped at the final step waiting for one word. In the same conversation, it also watched the countdown and noted that after switching to another restaurant, the auto-order time moved to 5:15, with some buffer to spare.
So what does it cost, and who can use it now
Grok Bot is in early beta, opened on August 11. Desktop and iOS are available now; enterprise customers are on a waitlist.
It’s included in three subscription tiers: SuperGrok Heavy, Cursor Ultra, and Cursor Teams Premium. At face value, Cursor Ultra is $200/month; the team tier, Cursor Premium Teams, is $120 per seat per month, adding centralized billing, a private skills and plugin marketplace, shared usage analytics, and enterprise single sign-on.
Officially, this started as an internal prototype. It caught on inside the company — sales outreach, marketing events, office admin, and bug-fixing teams all use it — and that’s when they decided to open it up.
Simplify the interface, remove the drudgery — that’s what this future is. A future where everything is within reach if you just ask.
Everything is computer — and Grok Bot is a computer, too. Turns out that’s all I ever wanted.
Matt Pauls
And the trade-off is right there in the open: you’re handing over a computer that can click through websites with your accounts, watched over by a few lines of plain English you wrote yourself.
Once you give AI a computer, automation no longer waits for an API
Cursor’s Matt Pauls used Grok Bot for weeks. This page covers what works and where the trust threshold sits.
↓ One page · Includes a moving diagram
Matt Pauls is always hunting for better tools. But every time he set up a “personal AI assistant” before, most of the time went into configuring servers, creating service accounts, and watching for crashed deployments. xAI released an early beta of Grok Bot on August 11, 2026. Its answer is to give every AI colleague its own computer: a persistent Linux machine in the cloud, always on, using your session to browse, open apps, and read/write files. Do a task once while it watches, and it saves the steps as a routine to run on a schedule or when triggered by Slack messages or Git activity.
Matt Pauls, who wrote this review, is from Cursor. SpaceX absorbed xAI in February and acquired Cursor in June. The product lines are now connected, which is why Grok Bot comes with the “Cursor Ultra” tier.
Previously, automating a website required the vendor to provide an API (an interface for software to talk to software) or MCP (a tool protocol for AI). That choice was up to them. Once you give an agent a computer, the test becomes: can a human click this page? If yes, Grok Bot can click it for you.
Automation depends on whether the vendor offers an API. Legacy systems and internal dashboards never make the cut.
Automation depends on whether a human can click it. If it opens in a browser, Grok Bot can get through.
xAI’s product page makes this explicit: Grok Bot works across apps, tools, and websites, including platforms with neither a clean API nor MCP.
Anything on a screen that stops a human also stops Grok Bot: logins, 2FA, CAPTCHAs, payments. When it hits one, it hands the computer back to the user at that gate. Once cleared, it takes the machine back and continues. The session stays on that machine, and all bots can use it until it expires.
✔ Once one bot clears a login, the others use the same session
✘ It will not confirm payments for you; the final click is yours
How do you keep an agent that uses your accounts and can click anything you can from overstepping? The control is a rule written in natural language in settings. Before Grok Bot takes any action, a separate reviewer module (an AI dedicated to oversight, like an expense approver at a company) checks it against that rule and decides to allow, block, or ask you.
Matt Pauls’ own take: Most people are used to setting rules for agents in code or JSON. Here, the rule is essentially a prompt — its effectiveness depends on whether another model follows it. He initially found this unsettling. After weeks of use, he saw no overstepping. Note: this review comes from a Cursor employee writing about a related company’s product; it is not a third-party evaluation.
These bots each maintain their own working memory and can message and assign tasks to each other:
- Demo Bot: Sorts through X bookmarks daily, picks a new tech, sends him a prompt for review, then spins up a runnable prototype in Cursor.
- Content Bot: Scans engineering and product Slack channels hourly, flags small updates for him, and can turn them into tweet drafts with one click.
- Grocery Bot: Watches Instacart and Amazon side-by-side, compares prices, manages two carts, calculates delivery fees, and reminds him to order on Fridays. When the Costco was out of fresh blackberries, it reported the gap instead of substituting frozen ones.
- DoorDash Bot: Watches Slack group-order links and pulls menu options with real prices, but it didn’t place the order — it left the “which one” decision to a human.
Numbers on this page: The 15 minutes and $28.57 are from Matt Pauls’ own usage and are personal records, not formal benchmark results. Subscription pricing is from xAI’s product page.
CONFIG KEYS
WATCH DEPLOY
NO API
GOES THROUGH
- × LOGIN
- × CAPTCHA
- × PAYMENT
BEFORE POSTING”