xAI's Grok Bot: named agents share one cloud computer, so bots aren't a security boundary

What Grok Bot is

According to a Teamvoy analysis published on dev.to, Grok Bot is a beta product xAI launched on 11 August 2026. It gives users named, persistent AI agents that run on a cloud computer with a browser, a filesystem and a terminal, sign into existing tools, and carry multi-step work through to completion while the user is away. It is a separate product from Grok, the chat assistant.

A contradiction in xAI's own material

The article, written by Teamvoy CPO Zhanna Yuskevych, builds on a discrepancy between two xAI statements issued on launch day. The launch page says each bot has its own computer. The documentation, published the same day, says all bots on an account share one persistent cloud machine, and explicitly advises against using separate bots as a security boundary.

Teamvoy's verdict is that only the documentation account would survive a security review. The shared machine means:

• A browser session opened by one bot is available to every other bot on the account. Sign one bot into a CRM and every bot can reach it.
• Files written by one bot sit on the same filesystem as those of every other.
• Deleting a bot does not remove its files or its saved logins.

Isolation between users is strict, the write-up notes: each user gets a dedicated microVM with its own kernel, memory and virtual devices. Isolation between bots on one account does not exist, and xAI's own material has reportedly described the arrangement as carrying a significant blast radius.

The credential handoff

When a bot meets a login page, a two-factor prompt or a CAPTCHA, it pauses and hands the computer back to the user, who types the credential and returns control. From then on, that session persists for every bot on the account.

Teamvoy frames this browser-driven reach as the product's genuine differentiator: API-first agents can only touch systems someone has instrumented, while a browser agent can reach the legacy SaaS tools and admin panels nobody ever built a connector for. The cost is reliability, since sessions can break on sites that block automation, expire, or demand a human step at inconvenient hours.

There is a review layer: an independent model evaluates shell commands, plugin calls and automation writes before they execute, and can allow them, require approval or deny them. The article stresses that this is a control on actions, not isolation between agents, and that it does nothing to change the shared-machine situation.

What the product is not

Drawing on xAI's documentation rather than outside criticism, the article lists limits:

• Not on-premises: there is no deployment inside a customer's own perimeter and no bring-your-own-image option.
• Not a model you pick: model selection is vendor-managed with no customer-facing picker; an enterprise allowlist exists, but the docs reportedly do not guarantee its enforcement.
• Not a data-residency commitment: the computers run in the US, and the US-only residency program does not cover Grok Bot by default.
• Not auditable on self-serve plans: audit logs, action recording, telemetry export and network allowlists sit behind the enterprise contract, and self-serve defaults to allowing all network access.

Why it matters

Teamvoy states the trade plainly: roughly five minutes from one message to a working agent, at the cost of no perimeter control. For low-sensitivity ops, sales and support workloads, that is a reasonable exchange. When a workload needs its own perimeter — data that cannot leave a region or VPC, a model that must be pinned for audit or cost reasons, credentials isolated per process, or systems that only exist behind a VPN — it is the wrong one, and the alternative is weeks of in-house design and operations work rather than minutes.

The wider lesson applies to any vendor in this space: named, separate-looking agents are an organisational convenience, not a security boundary. The right evaluation question is not whether an agent can be pointed at a system such as an ERP, but what every agent on the account could touch once one of them signs in. Teamvoy also cautions that the plan structure changed once between the August launch and October, so readers should verify pricing against the current page rather than older coverage.