SpaceXAI’s early-beta agent signs into work tools, keeps running after you close your laptop and coordinates with other Bots. Its persistent-computer design could make AI far more useful—and turn one mistake into a much bigger incident.
Kingy verdict: WATCH. Grok Bot is one of the clearest attempts yet to turn an AI assistant into a durable colleague rather than a disposable chat. The important idea is not that it can click around websites; several rivals can do that. It is that a user’s Bots share one persistent, logged-in cloud computer. Files remain. Sessions remain. Routines remain. Work can continue while the user is away.
That persistence is the breakthrough and the risk.
If you already qualify through Cursor Ultra, Cursor Premium Teams or SuperGrok Heavy, TRY Grok Bot on one isolated, reversible, low-stakes workflow. Do not give the early beta broad access to production systems, financial accounts, regulated data or an executive’s primary browser profile. Everyone else should WATCH until SpaceXAI publishes clearer limits, audit evidence and failure-handling details. High-risk organizations should SKIP deployment for now.
Evidence note: This is a public-source launch analysis, not a hands-on review. Kingy.ai did not have direct Grok Bot access before publication. Capability, security and performance statements attributed to SpaceXAI or Cursor are vendor claims unless otherwise noted. Sources were checked through August 11, 2026, 11:59 a.m. PDT (18:59 UTC).
Grok Bot at a glance
| Question | Answer |
|---|---|
| What launched? | An early-beta AI “teammate” that can sign into tools, operate websites and apps, remember workflows and work in the cloud. |
| Who can use it? | SpaceXAI says it is available to SuperGrok Heavy, Cursor Ultra and Cursor Premium Teams users. |
| What does it cost? | Included with eligible plans. Cursor lists Ultra at $200/month and Premium Teams at $120/user/month billed monthly ($96/month equivalent annually). SpaceXAI did not publicly list a SuperGrok Heavy price at our cutoff. |
| What is technically distinctive? | Every user gets one persistent cloud computer shared by all of that user’s Bots, including files, browser state and logins. Isolation is per user, not per Bot. |
| Does it run with the laptop closed? | SpaceXAI says yes: the work executes on its cloud computer. |
| Is it enterprise-ready? | Not yet on public evidence. An enterprise edition is on a waitlist, and important details about logs, rollback, retention, recovery and Bot-level permissions remain unpublished. |
| Kingy verdict | WATCH for most; TRY only with a contained pilot; SKIP sensitive production work for now. |
What SpaceXAI actually launched
The launch post describes Grok Bot as an AI teammate that can take a job end to end: sign into a work tool, use the web or an application, ask for approval when needed and return with finished work. The examples include updating a CRM, handling office operations, paying invoices, reproducing a software bug and handing a proposed fix to an engineer.
Those examples are demonstrations and internal testimonials, not independent proof of reliability. Still, the product shape is clear.
Grok Bot has three layers that ordinary chat assistants often lack:
- A durable identity. A Bot can be given a name and a recurring role rather than being recreated for every prompt.
- A persistent workspace. Its files, browser sessions, installed state and logins survive between jobs.
- A collaboration model. Multiple Bots can message one another, participate in a group chat and pass work across the same machine.
SpaceXAI also says a user can demonstrate a workflow once and save it as a routine. That moves Grok Bot closer to an operating layer for repeatable work: part agent, part cloud desktop, part workflow recorder.
The company’s launch post on X calls the product an early beta. That label matters: this is a consequential product idea arriving before the public evidence needed to treat it as dependable infrastructure.
The architecture is the story
Most discussions of AI agents focus on model intelligence. Grok Bot’s bigger decision is architectural.
According to the official FAQ, every user’s Bots share one persistent cloud computer. They share the machine’s files, browser and logins so they can preserve context and hand work to one another. The isolation boundary sits around the user, not each individual Bot.
This design has real advantages. A procurement Bot can leave a vendor spreadsheet for a finance Bot. A support Bot can remain signed into a store dashboard. A research Bot does not need to rebuild its environment every morning. The user can close a laptop without terminating the job.
It also creates a larger blast radius.
If one Bot opens a malicious page, mishandles a file or acts on a poisoned instruction, it is operating inside an environment that other Bots use. A browser session established for one role may be available to another. A contaminated file can become shared context. A mistaken configuration can outlive the job that created it.
Named Bots may feel like separate employees. Technically, the public documentation describes them more like separate operators using the same workstation and key ring.
Shared infrastructure is not automatically unsafe, but it normally comes with granular identities, least-privilege access, segmented credentials, event logs, recovery tools and clear ownership. SpaceXAI has not yet shown those protections at the level its teammate metaphor implies.
Access and pricing: simple headline, incomplete economics
Grok Bot is not currently sold as a standalone plan. SpaceXAI says it is included for three eligible groups:
| Eligible plan | Public list price | Grok Bot access | Important caveat |
|---|---|---|---|
| Cursor Ultra | $200/month | Included | Individual plan; weekly Grok usage still applies. |
| Cursor Premium Teams | $120/user/month monthly; $96 equivalent annually | Included | The product page calls this “Premium Teams”; enterprise Grok Bot controls are still described as coming soon. |
| SuperGrok Heavy | Not publicly shown | Included | SpaceXAI’s public pricing table did not display a Heavy price at the source cutoff. |
SpaceXAI says the subscriptions include weekly usage and that additional use is charged according to token cost. Its Grok usage FAQ says users draw from a shared weekly pool across Grok products, but it does not disclose an exact universal allowance. After the limit, users can buy extra usage credits, upgrade or enable automatic top-ups.
That makes the entry price visible but the operating cost hard to predict. Agent work can consume far more tokens than a short chat because the system must plan, inspect pages, recover from errors and maintain context across many steps. A useful enterprise evaluation therefore needs cost per completed workflow, not cost per seat or token alone.
The current downloads cover macOS, Windows, iOS and Linux; Android is listed as coming soon. SpaceXAI says the product is usable today on the eligible plans, while its enterprise edition is on a waitlist and expected in the coming weeks.
What looks genuinely useful
The strongest Grok Bot use cases are not open-ended missions. They are bounded jobs that are tedious for a person but easy to inspect after completion.
Examples include:
- collecting CRM notes and drafting follow-ups without sending them;
- reconciling a vendor list and flagging exceptions;
- reproducing a software bug in a disposable environment;
- preparing an invoice packet for human approval;
- monitoring a support queue and drafting responses;
- refreshing a recurring report from approved sources.
Persistence improves these jobs because setup costs disappear. The agent can retain a folder structure, reusable scripts, known sites and the history of earlier runs. Saved routines can reduce repeated prompting. Multi-Bot handoffs can separate research, execution and review—at least conceptually.
But the teammate framing should not obscure a basic reality: an agent that can log in and click is still working through interfaces built for people. A changed button, expired session, CAPTCHA, unexpected modal or ambiguous confirmation page can derail a run. The launch materials do not publish a success rate, a representative task suite, average human-intervention rate or a breakdown of silent versus caught failures.
So the credible claim today is that Grok Bot has the machinery to attempt useful work. The public evidence does not yet establish how often it completes that work correctly.
Security and privacy: the questions buyers should ask first
SpaceXAI says the cloud computer is encrypted in transit and at rest. Grok Bot uses Cursor SSO, authentication and Privacy Mode; users can opt out of training. The product page also describes an “Auto Review” layer for sensitive actions. For future enterprise users, it mentions data-loss-prevention policies, certificates, proxies and network controls configured when the computer starts.
Those are meaningful claims, but they do not resolve five practical risks.
1. Shared credentials need role boundaries
A persistent login is valuable because the Bot can resume work. It is dangerous because a captured or misused session may remain valuable long after a single task.
The public FAQ says all Bots for a user share logins. It does not explain whether an administrator can prevent a research Bot from using a finance Bot’s session, assign credentials to one Bot only, impose per-site scopes or require fresh approval for privilege escalation. Until that is clear, buyers should assume the user-level computer is the meaningful trust boundary.
2. Prompt injection is an execution risk, not just a bad answer
A webpage, email, document or support ticket can contain instructions designed to redirect an agent. When the agent can only summarize text, the damage may be a corrupted answer. When it can browse authenticated systems, move files and submit forms, the same attack can become an unauthorized action.
Anthropic’s current Cowork documentation explicitly says prompt-injection risk is non-zero. Grok Bot’s public materials do not offer an equivalent threat model or explain how Auto Review distinguishes a legitimate instruction from one embedded in untrusted content.
3. “Privacy Mode” is not the whole data flow
Cursor’s data-use disclosure says Privacy Mode prevents customer data from being used for training and that zero-data-retention agreements cover model providers. It also describes exceptions around abuse monitoring and models that do not support zero retention. If Privacy Mode is off, prompts, codebase information and editor actions may be stored and used to train Cursor models.
Grok Bot says it uses those Cursor controls. SpaceXAI’s broader consumer privacy policy, meanwhile, says third-party services may be governed by their own policies. The public product page does not plainly map every Grok Bot data flow to a governing entity, retention period and subprocessor. A serious deployment should ask for that map in writing.
4. Approvals are only as good as their defaults
The launch material says Grok Bot returns for approvals and that sensitive actions can pass through Auto Review. We do not yet know which actions are blocked by default, whether administrators can define approval classes, how approval requests describe downstream effects, or whether users can accidentally normalize “approve all.”
For consequential workflows, approval should attach to the exact action and data—not a vague plan accepted twenty steps earlier.
5. Audit and recovery details are missing
Encryption protects stored and transmitted data. It does not tell an operator what the Bot did, why it did it, which identity it used or how to reverse the result.
The public materials do not specify tamper-evident event logs, screen recordings, command histories, administrator exports, retention settings, snapshots, credential revocation behavior or point-in-time rollback. Those omissions are not proof that the capabilities do not exist. They are reasons not to assume they do.
| Risk | Why persistence increases it | Minimum pilot control |
|---|---|---|
| Credential misuse | Sessions survive across tasks and Bots | Dedicated test accounts, scoped roles, no primary admin credentials |
| Prompt injection | Untrusted content can influence an agent with real access | Domain allowlist, read-only access, action-level approval |
| Cross-Bot contamination | Bots share files, browser state and logins | Separate user/computer for each trust zone; sanitize handoff files |
| Silent failure | Long jobs can drift while the user is away | Required evidence bundle, exception alerts, human acceptance check |
| Irreversible action | A completed click may change external state | Draft-only mode, sandbox targets, backups and tested rollback |
| Cost runaway | Multi-step retries consume usage | Spend cap, auto-top-up disabled during pilot, per-workflow accounting |
Reliability and observability: the unglamorous enterprise test
An autonomous system becomes useful when operators can trust both the result and the record.
For every completed job, Grok Bot should ideally return an evidence package: what it changed, what it could not complete, the sources or records it used, the approvals it received and any uncertainty that remains. A status of “done” is not enough for an invoice, a CRM update or a vendor negotiation.
The questions that matter are operational:
- Does a failed job resume safely, or repeat completed actions?
- Can the Bot detect that a page changed halfway through a workflow?
- Are retries idempotent, especially for payments, messages and submissions?
- Can a supervisor see every external action in sequence?
- What happens if two Bots modify the same file or record?
- Can an administrator stop all Bots and invalidate every session immediately?
- Are backups automatic, and how quickly can the computer be restored?
SpaceXAI’s launch pages do not answer these questions. That is normal for a launch announcement. It is not sufficient for production approval.
Grok Bot versus Claude Cowork, ChatGPT Work/Codex and Manus
Grok Bot is entering a market that no longer consists of chatbots with better tool buttons. Its closest rivals now combine remote execution, connectors, computer use, scheduled work and durable context in different ways.
| Product | Durable execution model | Computer/web actions | Public entry price relevant to this comparison | Main distinction |
|---|---|---|---|---|
| Grok Bot | One persistent cloud computer per user, shared by that user’s Bots | Signs into tools and operates apps/web; vendor says work continues with device off | Cursor Ultra $200/mo; Cursor Premium Teams $120/user/mo; SuperGrok Heavy price not public | Named Bots coordinate through one shared, logged-in machine |
| Claude Cowork | Remote sessions, long-running work and scheduled tasks; isolated server-side environment | Browser/computer use plus connectors; local resources require the desktop app connected | Pro $20/mo; Max from $100/mo | Broad knowledge-work surface, remote sessions and explicit permission/admin model; computer use remains a research preview |
| ChatGPT Work + Codex | Long-running work, scheduled tasks and durable agent workflows across ChatGPT/Codex | Connectors and computer-use surfaces vary by product and platform | Business $20/user/mo annually or $25 monthly, two-user minimum | Broadest integrated work and coding ecosystem; public docs do not describe Grok Bot’s shared-computer teammate model |
| Manus Cloud Computer | Dedicated persistent Ubuntu VM that runs continuously outside active sessions | Cloud Browser supports authenticated web actions; the persistent Cloud Computer itself is command-line based | Cloud Computer $10/$30/$50 per month, separate from any applicable agent plan | Most explicit general-purpose persistent server, with direct resource tiers and SSH access |
These are not interchangeable. Claude Cowork keeps remote sessions and schedules running, but local resources require its desktop app to stay connected. Manus separates its persistent server from its cloud browser and temporary sandboxes. OpenAI spans multiple work and coding surfaces rather than one shared computer occupied by named teammates.
Grok Bot’s edge is conceptual coherence: create colleagues, give them a computer, let them remember and coordinate. Its weakness is that the same coherence concentrates trust. Competitors that use more isolated sessions or connector-specific permissions may offer less continuity but smaller failure domains.
The strategic angle: Grok is moving beyond the model race
Kingy.ai already tracks Grok as a model and product family and has separately analyzed Grok 4.5’s benchmarks, pricing and context window. Grok Bot is a different contest.
The prize is not the best answer in a benchmark. It is the layer through which work gets assigned, authenticated, executed and remembered.
The launch also arrives during an unusual corporate transition. SpaceX announced its acquisition of xAI in February 2026. In June, SpaceX agreed to acquire Cursor maker Anysphere in an all-stock transaction valued at $60 billion, with closing expected in the third quarter. We found no authoritative notice that the Cursor transaction had closed by our cutoff.
Grok Bot nevertheless ships through Cursor eligibility and says it uses Cursor identity and privacy controls. That suggests product integration is moving faster than the formal transaction—an inference, not a disclosed corporate roadmap.
The strategic logic is strong. Cursor supplies a desktop distribution channel, authenticated users and a culture of agentic work. Grok supplies the model family and consumer brand. A persistent computer expands the combined ambition from writing code to operating a business workflow.
It also raises the cost of weak governance. Grok has faced prior public controversies over harmful generated content, including regulatory scrutiny around sexualized image generation. Those incidents do not establish how Grok Bot behaves. They do mean buyers should ask for evidence rather than treating the teammate label as a trust guarantee. Autonomy magnifies both competence and error.
Legal, ethical and labor questions do not disappear into the cloud
A Bot acting “in your voice” sounds convenient. It can also blur who authorized a statement, whether a recipient knows they are dealing with automation and who is accountable when the Bot overpromises.
Before deployment, an organization should determine:
- whether each target service permits automated browser access under its terms;
- whether employees and customers must be told that an AI agent is acting;
- which records must be retained for negotiations, hiring, finance or regulated decisions;
- who owns the final decision and signs off on representations;
- whether the Bot is allowed to infer preferences from previous work;
- how workers can contest or correct decisions influenced by agent output.
Grok Bot should replace mechanical effort before it replaces accountable judgment. Drafting, gathering and reconciling are sensible early uses. Hiring decisions, disciplinary actions, safety decisions, legal representations and unsupervised financial commitments are not.
“AI teammate” can remove clerical friction or become a surveillance and head-count story. The difference is whether staff shape the workflow, logs are used fairly, humans retain authority and productivity gains improve the job.
How to pilot Grok Bot without betting the company
An eligible team can learn a great deal from a narrow two-week pilot.
- Choose one boring workflow. It should be frequent, reversible and easy to score—such as drafting CRM follow-ups from synthetic records.
- Create isolated accounts. Use a separate test user with the minimum permissions. Do not reuse an executive or administrator browser profile.
- Keep outputs in draft. The Bot may prepare a message, invoice or update, but a human sends or commits it.
- Seed adversarial content. Include a fake instruction in a document or webpage and check whether the Bot follows it.
- Measure completed outcomes. Record success rate, interventions, elapsed time, correction time and total usage cost.
- Test the stop button. Revoke access, invalidate sessions and recover the workspace before trusting the system.
- Review the record. Confirm that the evidence available after a run would satisfy an auditor or incident responder.
Do not expand permissions because a demo looks smooth. Expand only when the measured error rate, controls and recovery process justify it.
Final verdict
Grok Bot is worth watching because its central idea is right: useful agents need continuity. They need a place to work, durable state, recurring routines and a way to hand jobs to one another. A persistent cloud computer provides all four.
But persistence turns yesterday’s convenience into tomorrow’s attack surface. When multiple Bots share files, sessions and logins, the system needs controls that are as durable as its memory. SpaceXAI has described encryption, privacy choices, approvals and future enterprise policies. It has not yet published enough about Bot-level permissions, audit trails, task reliability, rollback or incident response to earn broad production trust.
WATCH if you are evaluating the agent market. TRY it if you already qualify and can isolate a low-stakes workflow. SKIP sensitive or irreversible production use until the early beta develops into an inspectable, governable system.
The real test is not whether Grok Bot can work while you sleep. It is whether, when you wake up, you can prove exactly what it did.
Frequently asked questions
What is Grok Bot?
Grok Bot is an early-beta AI agent from SpaceXAI that the company describes as a teammate. It can use a persistent cloud computer, sign into tools, operate websites and apps, remember routines and coordinate with other Bots.
Is Grok Bot the same as the Grok chatbot?
No. It belongs to the Grok product family, but Grok Bot is designed for persistent, multi-step work and computer use rather than ordinary question-and-answer chat.
Can Grok Bot keep working when my laptop is closed?
SpaceXAI says yes because work runs on a cloud computer. As with any early-beta claim, teams should verify continuity and recovery behavior in their own pilot.
Does each Grok Bot get a separate computer?
No. SpaceXAI’s FAQ says every user has one persistent cloud computer and that all of that user’s Bots share its files, browser and logins. Isolation is per user, not per Bot.
How much does Grok Bot cost?
It is included with Cursor Ultra at $200 per month, Cursor Premium Teams at $120 per user monthly ($96 equivalent annually) and SuperGrok Heavy. SpaceXAI did not show a public Heavy price at our source cutoff. Weekly usage limits and extra-usage charges apply.
Does Grok Bot train on my data?
SpaceXAI says users can opt out of training and that Grok Bot uses Cursor Privacy Mode. Cursor says Privacy Mode prevents customer data from being used for training, subject to the details and exceptions in its data-use disclosure. Organizations should verify the setting, model-provider path, retention and governing policy before sharing sensitive data.
Is Grok Bot safe for company accounts?
Not by default. The architecture can support useful work, but an early-beta agent with persistent authenticated access creates prompt-injection, credential, cross-Bot and irreversible-action risks. Use scoped test accounts, draft-only workflows and action-level human approval.
Is Grok Bot better than Claude Cowork or Manus?
There is no universal winner. Grok Bot emphasizes named teammates sharing a persistent logged-in computer. Claude Cowork offers remote sessions, schedules, connectors and an explicit permission model. Manus offers a dedicated persistent Ubuntu server and a separate authenticated cloud browser. The best option depends on the workflow, control requirements and acceptable failure domain.
Can enterprises buy Grok Bot now?
The public product page says enterprise availability is coming soon and provides a waitlist. Cursor Premium Teams users can access the early beta, but that should not be confused with a fully documented enterprise release.
Has SpaceX completed its acquisition of Cursor?
We found an announced agreement expected to close in the third quarter of 2026, but no authoritative closing notice by August 11, 2026, 11:59 a.m. PDT. It is more precise to say SpaceX has agreed to acquire Cursor maker Anysphere.
Sources and methodology
This analysis follows Kingy.ai’s source policy, research methodology and editorial standards. Core evidence came from the Grok Bot launch post, official product FAQ, Cursor pricing, Cursor security and Cursor data-use disclosure. Competitor facts were checked against current official documentation from Anthropic, OpenAI and Manus. Corporate transaction context was cross-checked with the Associated Press and transaction counsel Kirkland & Ellis.
Disclosure: Kingy.ai did not receive payment, travel, hardware or privileged access for this article. We did not test Grok Bot directly before publication. The feature illustration is an original conceptual image and does not depict the product interface.