Is Grok Bot safe? What protects you, and what's on you

Grok Bot is reasonably safe at the infrastructure level and riskier at the account level. Cursor isolates each user in a dedicated microVM, keeps plugin tokens off that machine and excludes your data from training with Privacy Mode on — but every Bot you own shares your logins and Vault, outside content can try to steer a Bot, and an October 5 password-snapshot bug had no confirmed fix by October 25.

The short answer#

This is a summary of SpaceXSI's docs, Cursor's help and attributed staff forum replies — not an audit. We have not tested these controls.

The trust zone is you, not the Bot#

The security FAQ says each user gets a dedicated Firecracker microVM with its own kernel, memory and virtual devices. That's a strong wall between you and other customers.

Inside your account there is no wall. All your Bots share that one computer, so any browser session, file or command-line credential on it is usable by every Bot. Cursor's help says a sign-in lasts for all Bots until it expires. A Bot has no identity of its own and never holds more access than you.

A Cursor staff member said on October 2 the team is working on per-Bot browser sessions; until that ships, treat the machine as one zone. Plugins are account-wide too, and blocking a plugin doesn't block that service's website — only Enterprise Network Controls close that gap. Details in our shared computer guide.

Passwords, Vault and the snapshot bug#

Signing in#

The documented method is to take over the Bot's screen and type the password, passkey or code yourself. The docs say not to send passwords or one-time codes in ordinary chat. Note the 0.75.2 change: if you already pasted one, the Bot now uses it instead of refusing. That makes a pasted password functional, not safe.

The October 5 Secure Form issue#

The Secure Form is the in-chat form that fills your answers into a page (since 0.71.2 it handles multi-field logins and embedded frames). On October 5 a user reported that after it filled a password, the Bot's pre-click snapshot showed the password in plain text in tool output. Staff replied the same day that a fix was in progress and recommended Open the screen instead. No changelog from 0.68.1 to 0.75.5 mentions it, and the thread had no Cursor post after October 5 when checked October 25. If you used the form for a password, change that password.

Vault: convenient, account-wide#

Vault (0.75.5, needs 0.75.2+) stores logins, cards and contact info in Settings → Vault. Cursor's help says Bots never see saved passwords, card numbers or security codes. The trade-off is reach:

• Every Vault item is available to every Bot; you can't scope one to a single Bot.
• No setting makes a Bot ask before using a saved card. Cursor's advice: don't save the card if you want per-payment approval, and leave Securely save to Bot's vault unchecked.
• Since 0.77.0, a Payments tab sets a Default payment method Bots try first, and Bots try Vault before a password manager.
• A CSV import (under 5 MB, read locally) leaves an unencrypted file you should delete — and makes every imported login usable by every Bot at once.

The docs list where the Bot hands you the screen instead: single sign-on, passkeys, CAPTCHAs, approvals on another device, QR codes and bank card verification. The resulting session then stays on the computer for every Bot.

Money: more ways to pay every release#

Bots can pay with X Money and Stripe Link (October 11), Shop Pay (0.75.2), Vault cards (0.75.5), and since 0.78.1 a product card's Buy now starts an order you approve, after which the Bot tracks shipping. Three 0.78.1 templates act on subscriptions — starting and cancelling free trials, cancelling plans you pick, watching renewal prices — and the changelog says Bots confirm before changing a subscription.

Two built-in behaviors (October 11) add friction: before an irreversible action like buying, a Bot checks your messages for approval, and it asks before sharing data a bank or brokerage connector returned. Those are behaviors, not settings. Your actual boundary is what you save in Vault plus an Ask first rule on purchases.

Approvals and Auto-review are loosening#

Approval cards offer Allow once, Always allow (can save a rule) or Deny. Auto-review is a separate model that checks risky actions — shell commands, plugin calls, computer use, routine and trigger changes, Cloud Agent launches — but not every side effect; memory writes and most settings changes aren't covered. Ask first rules always stop a match and beat Allow rules.

The October trend is fewer cards:

Approvals raised by routines, triggers or other Bots expire after about 30 minutes and the action doesn't run. Fewer cards means your wording carries the weight — see our permissions guide.

Prompt injection and your data#

The security page states plainly that web pages, plugin results and command output can try to steer a Bot. Grok Bot marks outside content as untrusted and layers Auto-review over model-independent controls (network policy, per-action approvals, per-user isolation), which reduce but don't eliminate the risk. The worst setup is broad reading plus unattended writing: a routine that reads every email and can also send or pay.

On data: Grok Bot requires cloud storage, so Legacy Privacy Mode is unsupported. x.ai/bot says the computer is encrypted in transit and at rest. Idle computers hibernate (not delete). Under Cursor's DPA data is deleted or returned within 30 days of written direction after service ends; account deletion removes data within 30 days. Enterprise Action Recording keeps scrubbed actions for 90 days. Computers run in the US today, and Anysphere holds ISO/IEC 27001 and 42001 certifications that include Grok Bot.

Shared Bots change the picture#

On Shared Bots, each teammate's chat is private and OAuth plugins use the asker's own account. Shared by design: team memory and the Bot's secrets. Slack channels share one computer for that Bot. Since 0.77.0, unlinked Slack users can't use the owner's logins through the Bot, and admins can restrict sharing to admins. Cursor's help says Vault isn't supported on Shared Bots, though 0.78.1 lets managers add logins to a Shared Bot's own Vault — the sources disagree.

Ten-minute hardening checklist#

• Privacy Mode on, if training opt-out matters.
• Ask first rules for sending, purchases, deletions and publishing (Settings → General → Auto-review), then confirm them on the Permissions screen.
• Email and Slack drafts left on.
• Execution on Local Computer set to Never allow.
• Plugins preferred over browser logins; revoke access when a task ends.
• Passwords typed on the Bot's screen, never pasted into chat or the Secure Form.
• Vault reviewed: low-stakes logins only, no cards unless you accept no per-use approval.
• Banking and admin accounts kept off the shared computer.
• Finished projects cleaned up: routines paused, sites signed out, /workspace files removed. Deleting a Bot (0.75.2) erases its chats, memory and routines, but the note doesn't mention shared-computer files.

A longer version is in our setup checklist.

Who should and shouldn't use it yet#

Good fit: research, drafting, summaries and reports where the Bot reads and you approve writes; teams willing to set Ask first rules and keep drafts on.

Wait or isolate: anyone who needs one agent fenced off from another's logins; workflows that must never pay without a click while cards sit in Vault; regulated accounts you can't keep off a shared machine.

Our take#

Grok Bot's isolation between customers is solid; the weak point is how much one account's Bots share and how quickly October releases cut approval prompts. Treat your whole account as one trust zone, keep cards and high-value logins out of Vault, and put Ask first rules on every irreversible verb. Until Cursor confirms the Secure Form fix, type important passwords yourself.

Frequently asked questions#

Does Grok Bot train on my data?#

Not with Privacy Mode on. The docs say training opt-out follows your Cursor privacy settings and that customer data is not used for training with Privacy Mode enabled. A Cursor staff member said on August 12 this covers Cursor and every model provider, including xAI. Legacy Privacy Mode, which stores nothing, does not work with Grok Bot.

Is the Grok Bot Secure Form safe for passwords?#

Not yet, by our reading. On October 5 a Cursor staff member confirmed a report that a password filled by the Secure Form appeared in plain text in a page snapshot and said a fix was in progress. No changelog through 0.75.5 mentions a fix, and the thread had no update by October 25. Type passwords on the Bot's screen yourself.

Can one Grok Bot be kept away from my bank login?#

No. All Bots on an account share one cloud computer with its files, browser sessions and command-line credentials, and the docs say not to treat separate Bots as a security boundary. Vault items are also available to every Bot. If a login must stay isolated, keep it off Grok Bot or use a separate Cursor user, which gets its own computer.

Can Grok Bot spend my money?#

Yes. Bots can pay with X Money and Stripe Link (October 11), Shop Pay (0.75.2) and cards saved in Vault (0.75.5). Cursor's help says no setting requires approval each time a saved card is used. Bots check your messages for approval before irreversible actions, but that is behavior, not a setting, so add an Ask first rule for purchases.

Can a website trick Grok Bot into doing something?#

It can try. The security docs say web pages, plugin results and command output can attempt to steer a Bot, and that defenses such as untrusted-content marking, network policy and per-action approvals reduce but do not eliminate the risk. Keep sending, buying, deleting and publishing behind Ask first rules so a steered Bot still stops.

Where is Grok Bot data stored?#

In Cursor's cloud. The docs say Grok Bot computers run in the United States today, which is separate from Cursor's US-only data residency program. Files and browser sessions persist on a durable disk, plugin tokens stay on Cursor's backend, and deleting your account removes data within 30 days according to Cursor's help.