Is Grok Bot safe? Security, privacy and your logins

Grok Bot has real protections: a dedicated cloud computer per user, connector tokens kept off that computer, passwords that are filled in without being shown to the model, and approval checks on consequential actions. It is not risk-free. Your own Bots share one computer, the service needs cloud storage, and a reported Secure Form leak shows why sensitive sign-ins deserve extra care. Start with limited access and keep sending, paying and deleting under your control.

The short answer#

This is a documentation-based review, not a penetration test or audit. It reflects SpaceXSI's security docs (updated October 12 and 20, 2026), Cursor's help, and a forum report, read on October 30, 2026. Check the current pages before connecting a sensitive account.

What can Grok Bot access?#

Only what you give it. A Bot acts as the signed-in member and never holds more access than that person. Connector OAuth tokens stay on Cursor's backend, and Bots call tools without receiving them. The hosted computer can reach websites and services available to it, and local-computer execution is a separate setting.

The shared-computer boundary#

Every Bot you own shares one cloud computer. The approvals page says files, browser sessions and command-line credentials on it are available across your Bot roster, and tells you not to use separate Bots as a security boundary. If you sign in for one Bot, treat the login as available to all of them.

For sensitive work: sign out when a service should no longer be available, remove temporary files from /workspace, revoke connectors you no longer use, and remember that deleting a Bot does not remove computer files or browser sessions. See our shared computer guide.

Where does your data live?#

Residency needs care. The security page says Grok Bot computers run in the United States today, and that this is not the same as Cursor's US-only data residency program, which does not apply to Grok Bot by default. If you need a written residency commitment, ask your account team. Hosting is cloud-only: on-premises, in-perimeter and bring-your-own-image deployments are not supported.

Anysphere, the company behind Cursor, holds ISO/IEC 27001 and 42001 certifications, and the docs say Grok Bot is in the current scope (certificates at trust.cursor.com). A company certification is not a review of your workflow.

Does it train on your data?#

Storage, training and provider retention are three separate questions.

• Storage: required. Grok Bot does not support Legacy Privacy Mode, so an older privacy setting does not carry over.
• Training: the docs say training opt-out follows your Cursor account or team settings, and that with Privacy Mode enabled customer data is not used for training. While you are on a team, the team's privacy mode governs you.
• Provider retention: Zero Data Retention follows Cursor's provider agreements, and the docs add that providers may run abuse and safety classifiers and flagged data may be stored for investigation.

"Not used for training" does not mean "never stored" or "never processed". If a contract limits subprocessors, ask your account team before rollout.

Who can see your passwords?#

By design, not the model. There are three routes:

1. Vault. Saved logins, cards and contact info (Settings, Vault). Cursor's help says Bots never see saved passwords, card numbers or security codes.
2. Secure Form or secret card. The value is masked, left out of the transcript and not shown to the model; the page receives it.
3. Handing over the screen. For passwords, passkeys, two-factor codes, CAPTCHAs and payment confirmations, you take over the computer, type it yourself and choose I'm done.

The Bot can still use the resulting session. Hiding a password from the model does not stop a Bot from using an account you are signed in to, and the session stays on the computer for every Bot. A card saved in Vault has no per-payment approval setting; Cursor's advice is not to save it if you want to approve every payment.

The October 5 Secure Form report#

On October 5, 2026 a user reported on the Cursor forum that after a Secure Form filled a GitHub password, the Bot's browser took a page snapshot before clicking Sign in and the password appeared unmasked in tool output and the session transcript. The report says it did not appear in chat or leave the computer, and that the user changed the password. It was on desktop 0.66.0. A Cursor staff member replied the same day that a password filled by the Secure Form should not appear in a snapshot, that the team was working on a fix, and that the safest route until then is Open the screen, type the password yourself and press Sign in yourself.

What we could not confirm: that it was fixed. We found no changelog entry for it through the 0.78.1 notes we could read, and the security docs do not mention it. One report is not proof that every Secure Form leaks. For sensitive accounts, use the screen handoff. If you used the form for a password you care about, change it.

Prompt injection#

Not fully solved. Web pages, plugin results and command output can try to steer a Bot. The docs describe layers: Auto Review checks actions against your request, outside content is marked as untrusted data, and below that sit controls that do not depend on a model: per-action approvals, the network policy (Enterprise only) and per-user isolation. They say these reduce but do not eliminate the risk.

Auto Review covers shell commands, plugin calls, computer use, routine and trigger changes, and Cloud Agent and subagent launches. It does not review every side effect; memory writes and most settings changes are the docs' examples. Our permissions guide turns this into rules and prompts.

A safer setup#

1. Connect only what the task needs, with scoped service accounts where the source system supports them.
2. Start read-only, with draft outputs.
3. Set local execution to Never allow unless a Bot needs your files. The default is Ask every time.
4. Keep sending, publishing, purchasing, deleting and production changes behind approval.
5. Use narrow Ask first rules, not broad Allow rules.
6. Type sensitive passwords yourself on the Bot's screen.
7. Clean up after sensitive work: pause routines, sign out, remove files, revoke connectors.
8. Test before you trust it with our workflow testing guide.

Our verdict#

Reasonable for research, drafting, summaries and reports where the Bot reads and you approve writes. Be stricter for highly sensitive credentials, financial actions, confidential company data and production systems, and get the privacy, retention and residency commitments that apply to your account in writing.

Let the Bot prepare and investigate within a narrow scope, and keep permission changes, outside messages, payments and deletion under your control.

Frequently asked questions#

Can Grok Bot see my passwords?#

The docs say passwords saved in Vault and values entered in a Secure Form are filled into the page without being shown to the model. On October 5, 2026 a user reported a Secure Form password appearing in a page snapshot, and staff said a fix was in progress. We found no confirmation it was fixed, so type sensitive passwords yourself on the Bot's screen.

Does Grok Bot store my data?#

Yes. Grok Bot requires data storage and does not support Legacy Privacy Mode. Each member's computer keeps files, browser sessions and saved browser data on a durable disk across sessions.

Does Grok Bot train on my data?#

The docs say training opt-out follows your Cursor account and privacy settings, and that with Privacy Mode enabled customer data is not used for training. Check the setting on the account or team that gives you access.

Are my Bots isolated from one another?#

No. All of your Bots share one cloud computer, so files, browser sessions and command-line credentials are available to every Bot on your roster. Separate Bot names are not a security boundary.

Can Grok Bot touch my own computer?#

Only through local execution, which has its own setting under Settings, General, Bot, Execution on Local Computer. The default is Ask every time, and the docs recommend Never allow unless a Bot has a specific reason to work on local files.

Does Auto Review make Grok Bot completely safe?#

No. Auto Review is a model that checks risky actions before they run, and the docs say it does not review every side effect, such as memory writes and most settings changes. Use it with narrow permissions and approval for consequential actions.

How do I remove a saved password?#

Open Settings, then Vault, and remove the login. Also sign out of the website on the shared computer if the session should end, because deleting a Bot does not remove computer files or browser sessions.