xAI launches Grok Bot at $200 a month. It signs in as you, so your audit log will say you did it

What xAI actually shipped

Grok Bot launched on 11 August 2026 as an early beta. The pitch is not a chatbot and not a coding agent. It is a set of persistent workers that hold a cloud computer of their own and operate your software the way a person does.

The company is explicit about the mechanism, and the mechanism is the story:

Log Grok Bot in once. It uses your apps and websites just like you would, including the tools that are harder to navigate.

Tools that are harder to navigate is xAI naming the design goal. Where a product has a clean API or an MCP server, an agent can be given a scoped token. Where it does not, Grok Bot drives the interface with a signed-in session. That is why it reaches everything, and it is also why nothing about it is scoped.

What is available today, and to whom

Tier	Price	Signs into your tools	SSO	DLP, proxies, certs, network controls
SuperGrok Heavy / Cursor Ultra	$200 per month	Yes	Not listed	Not listed
Cursor Premium Teams	$120 per seat per month	Yes	SAML/OIDC	Not listed
Enterprise	Not published	Yes	Yes	Yes, set at boot

Enterprise is a waitlist. So on 12 August 2026 the tiers you can actually buy are the two without data loss prevention, without egress control, and in the $200 case without single sign-on.

Signing in is not the same as being authorised

Every agent integration built on OAuth or MCP produces a second identity. The agent gets its own token, its own scopes, its own entry in the audit log and its own revocation path. That separation is the entire security value.

Grok Bot removes it. You sign a human session into a computer the agent controls, and from that moment the agent is you.

One sign-in, and the person is never needed again

x.ai/bot · read 12 Aug 2026

Separate identity to revoke

None

Scope narrower than yours

None

DLP, proxies, network policy

Enterprise waitlist

Three consequences follow, and none of them is hypothetical.

Attribution is gone. Zendesk, Gmail and Salesforce will record your user account. After an incident there is no field that separates what you did from what a bot did on your behalf.

Scope is whatever you have. There is no read-only mode, no per-scope consent screen, and no way to give an expenses bot the expenses system and nothing else. The session carries your full entitlements into every tab it opens.

Revocation is all or nothing. There is no token to withdraw. Cutting off one misbehaving bot means changing the password on the underlying account, which logs out you and every other bot at the same time.

The approval step is the feature being removed

This is where the marketing is unusually candid, and it is worth quoting rather than paraphrasing.

On putting several bots in one thread:

Put a few Bots in the same thread and they pass work between themselves. You watch them take action instead of approving every step.

On what a bot does with an inbound customer email:

Acme replied on pricing, same thread as last quarter. I already had the context, so I answered without waiting on you.

And a named customer testimonial on the launch page:

I showed Grok Bot a workflow once and now I just fully trust it to run forever. I feel like I am 2-3x more efficient because it does it without me verifying and reviewing.

Set that against the security answer in the same product FAQ:

Sensitive actions can go through Auto Review before they run.

Can, not do. And Auto Review is a model reviewing a model, which is a reasonable engineering control and is not an authorisation boundary. A vendor that quotes a customer celebrating the absence of review, on the same site where review is optional, has told you where the default sits.

What one morning of it actually looks like

xAI's own product screens put numbers on the autonomy, and the numbers are more useful than the prose around them.

These are marketing renders rather than a measured run, with invented names in them, so treat them as what the vendor is advertising rather than as observed behaviour. That is exactly why they are worth reading closely: this is the best case, drawn by the people selling it. An Inbox Manager bot is shown a weekend backlog of 41 unread messages and reports:

One weekend inbox, swept by a bot

What the bot did	Count	Seen by a human first
Archived newsletters and receipts	26	No
Replied to routine threads	9	No
Drafted and held for reading	6	Yes
Flagged a contract question	1	Yes

Forty-one messages in, seven human decisions out. Nine replies go out with nobody reading them, on the grounds that they were routine, and the bot is what decided which ones were routine. The single flagged item was a contract question, which is the right call and also shows where the control actually sits: in a classifier, not in a policy.

A second screen shows a sales bot touching four systems in one overnight run. Salesforce for a 52-account list, Hex for three lookalike segments, LinkedIn to skip four recently contacted profiles, and a sequencer holding 36 drafts at zero sent. None of that is exotic. It is four production systems reached by one agent, under one identity, in one job.

Bot to bot is the part with no precedent

Delegation between agents is the genuinely new exposure. A chief-of-staff bot assigns work to a specialist bot, and xAI says they pass work, assign ownership, and only pull you in for judgment calls.

In xAI's own group-chat screen, a chief-of-staff bot closes a project by assigning named follow-ups to two other bots, then proposes the next move itself: “that leaves the pipeline: nobody's touched the quiet accounts. i'd spin up a dedicated agent for outbound.” An agent proposing to create another agent is a provisioning decision, and it is being taken in a chat window.

The human is no longer in the chain. Whatever reached the first bot, including anything it read in an inbox, can become an instruction the second bot executes in a different system under the same identity. This site covered the mechanism while it was still theoretical, in MCP tool access and the enterprise perimeter and again in agentic browsers widening the prompt injection surface.

This is the third arrival of the same shape, and the trend runs one way.

The same confused deputy, three products deep

1. Jul 2026

   MCP servers

   A model gains scoped tool access. The token is separate, and it is revocable.

2. Jul 2026

   Agentic browsers

   A model drives a browser holding your cookies, so page content becomes instruction.

3. 11 Aug 2026

   Grok Bot

   Persistent agents hold a signed-in session, run continuously, and hand work to each other with no human step between.

The operations example xAI gives is an agent processing invoices received in Gmail. An invoice is a document supplied by somebody outside your organisation. That is untrusted input, read by an agent, which then acts in your finance systems as you. The published catalogue lists 56 job templates across nine categories, including an Apartment Scout that applies for the ones you pick, so the blast radius is not confined to work systems either.

What to do this week

The position

Grok Bot is the most interesting product launched this month, and the reason is not the model. It is that xAI has correctly identified what actually blocks agent adoption, which is that most enterprise software has no usable API, and has solved it by giving up on scoped machine identity altogether.

That is a trade rather than an oversight, and it is a defensible one. What is not defensible is shipping it to the tiers a person can buy on a card while data loss prevention, egress control and network policy sit behind an enterprise waitlist. The autonomy is generally available and the containment is not.

Nothing in this briefing requires a vulnerability. Every consequence follows from the product working exactly as documented.