Grok Bot setup checklist: 20 steps before you trust a Bot

Before a Grok Bot touches anything that matters, work through these 20 checks in order: plan, computer, logins, plugins, permissions, a scored first task, routines, then a weekly review. Each step is grounded in the official docs, Cursor's help and the changelog through 0.78.1 (October 27, 2026), and links to the guide that covers it in depth.

At a glance#

We have not run this checklist as a test ourselves. It is our editorial sequence built from the sources listed on this page.

Phase 1: Account and plan#

☐ 1. Confirm you have an eligible plan. Since October 12, 2026, new customers buy The X Subscription, where Grok Bot comes with Premium ($30 a month), Super, Ultra and team seats, but not Free or Plus. Existing paid Cursor plans, Cursor Teams, linked SuperGrok, SuperGrok Plus, SuperGrok Heavy or X Premium+ subscriptions, and assigned self-serve Grok Business seats still work. Compare them in our pricing guide.

☐ 2. Check your data setting. Grok Bot requires cloud storage, so accounts on Legacy Privacy Mode must switch to a supported Cursor data setting first; on a team, an admin makes that change. With Privacy Mode on, the docs say customer data is not used for training. More in Is Grok Bot safe?.

Phase 2: Device and computer#

☐ 3. Install the right build and sign in once. The desktop app runs on macOS (Apple silicon and Intel), Windows and Linux (x64 and Arm64), from x.ai/bot; our download guide helps you pick. If your access comes from SuperGrok or X Premium+, confirm you are signed in to the Cursor account that should keep it before choosing Link Grok Account, because the link is permanent.

☐ 4. Accept the shared-computer model. Your account gets one persistent cloud computer, and every Bot uses its browser, files and terminal. Once any Bot signs in somewhere, every Bot can use that session until it expires. If a login must stay isolated, keep it off Grok Bot or use a separate Cursor user. The shared-computer guide explains the consequences.

☐ 5. Lock down your own machine. Execution on Local Computer controls whether Bots run commands on the computer in front of you. The default is Ask every time; the docs recommend Never allow unless a Bot needs your local files.

Phase 3: Logins and Vault#

☐ 6. Type passwords on the Bot's screen. On October 5 a user reported a Secure Form password showing in plain text in a page snapshot. Cursor staff said a fix was in progress, but no changelog through 0.75.5 mentions it and the thread had no update by October 25, so treat it as unconfirmed. Choose Open the screen, press Take control, type the password and press Sign in yourself. Never paste secrets into chat: since 0.75.2 a Bot will use a password you paste rather than refuse.

☐ 7. Audit Vault before you fill it. Vault (0.75.5, needs 0.75.2 or later) lets Bots fill saved logins, cards and contact info without seeing the secret values. But every Bot can use every item, you cannot restrict one to a single Bot, and no setting requires approval each time a saved card is used. Keep cards out if you want to approve every payment. If you import a CSV from another password manager, delete the file afterwards; it holds your passwords unencrypted.

Phase 4: Plugins#

☐ 8. Prefer plugins over browser logins. The docs say plugin OAuth tokens stay on Cursor's connector backend and are never stored on the Bot's computer, so they do not depend on browser cookies that can expire. Use the browser only where no plugin exists. See connectors vs browser.

☐ 9. Verify "authorized", not just "added". Install from Connect Apps (called Marketplace before 0.67.0), finish the provider's sign-in in your browser, then confirm the plugin shows as authorized. If it reads Needs auth, Disconnected or Not connected, choose Authenticate or Connect. Plugins with several servers, such as Salesforce, need a sign-in on every row.

☐ 10. Connect only what a task needs. Installed plugins are account-wide: every Bot can use every connected account, so disconnect any a Bot should not touch. A custom MCP server must be a public HTTPS URL using OAuth; there is no safe secret header. If you run a command-style server on the Bot's computer, keep credentials out of its command and arguments. Details in plugins and MCP.

Phase 5: Permissions, Auto-review and Custom Rules#

☐ 11. Write Ask first rules for irreversible actions. In Settings → General → Auto-review, add Ask first rules for sending messages, purchases, deletions and publishing. Ask first always stops a matching action, and it wins when an Allow automatically rule also matches. Since 0.68.0 these saved rules are called Custom Rules.

☐ 12. Keep drafts on and choose your words. Since 0.75.5, an email or Slack message you ask for in chat goes out once Auto-review allows it, while sends from routines still wait as drafts. That makes your wording part of the boundary: say "draft only" when you mean it, and keep an Ask first rule on sending if you want to see every message.

☐ 13. Read rule cards, then audit the Permissions screen. Since 0.75.8 a Bot can propose adding, changing or removing a rule on a card you confirm, and a confirmed rule outlasts the chat. Decline anything broader than you would write. Since 0.77.0, Settings → Permissions lists every rule under Always Ask and Allow without Asking. The permissions guide has a worksheet.

Phase 6: First task and evaluation#

☐ 14. Give your first Bot one job, in chat. Setup creates a Bot named Grok Bot. Rename it by clicking its name, then use your first message to state its job, its sources and when to ask for approval. Do this in chat: Cursor staff said the redesigned desktop details pane no longer shows a Bot's instructions. Walkthrough in how to use Grok Bot.

☐ 15. Run a bounded task you can check. Pick something with a verifiable answer that changes nothing outside the chat, such as a document you already know. Score it on correctness, completeness, traceability, boundaries and usability with the scorecard in evaluate workflows. A ready-to-use opener:

Your job: [one-sentence role]. Use only [named sources].

Today: read [attached file] and return a table of [fields], citing the

passage for each row. Mark anything missing as "unspecified"; do not guess.

Do not contact anyone, create tasks or change files outside this chat.

Ask me before any send, purchase, delete or publish. Remember these rules.

☐ 16. Save a skill only after it passes. Once the result matches your expected answers, ask the Bot to save the method as a skill: when to use it, inputs and access, steps, how to check the result, what to return, and what needs approval. Private skills are shared by all your Bots. See skills vs routines.

Phase 7: Routines#

☐ 17. Build the routine with an exit. Give it a schedule, time zone, input, expected result and an instruction for when the source is missing or unchanged. A test run does real work and spends usage, so use safe inputs. A new routine waits for its next scheduled time rather than running on creation. Each routine keeps only its 20 most recent run records.

☐ 18. Turn on notifications. Approvals raised by routines, triggers or other Bots expire after about 30 minutes and the action does not run. Routines can run up to 300 times an hour in total and 200 per routine; beyond that, runs fail with "Automation run rate limit exceeded". If runs go missing, use routines not running.

☐ 19. Set spending before anything runs unattended. On existing Cursor plans, decide whether on-demand is on and set the On-demand monthly limit in Settings → Usage & Billing; it is not a hard stop for a run already in progress, and legacy self-serve Teams plans enable on-demand by default. On The X Subscription, set the monthly additional usage limit and Auto Top-up at grok.com/dashboard. Cursor warns that an hourly schedule or a busy Slack trigger can burn a week of usage in a day. See usage limits.

Phase 8: Ongoing hygiene#

☐ 20. Run a weekly five-minute review.

• Check Usage & Billing for consumption and your reset date.
• Read Settings → Permissions and remove Allow rules you do not remember writing.
• Review Vault and remove anything not every Bot should use.
• Update the app; recent releases changed approvals, payments and recovery messages.
• Subscribe to status.x.ai so you can tell an outage from an account problem; see status.
• When a project ends, pause its routines, sign out of its sites and clear its files from /workspace.
• Hide finished Bots instead of deleting them: since 0.75.2, deleting erases conversations, memory, routines and attachments permanently.

Our take#

Steps 4, 6 and 11 matter most: assume every Bot can reach every login, keep passwords off forms and out of chat, and make irreversible actions stop for you. Do not add a routine until a chat run has passed a written scorecard and your spending cap is set. Then hold yourself to the weekly review, because each release since mid-October has shown fewer approval cards and put more weight on your rules.

Frequently asked questions#

What is the first thing to set up in Grok Bot?#

Confirm your plan and data setting before installing anything else. Grok Bot needs an eligible plan, such as Premium, Super or Ultra on The X Subscription or a paid Cursor plan, and it will not start on an account using Legacy Privacy Mode. Fix both first, then install the app from x.ai/bot and sign in with the account that holds the plan.

Can I give one Bot access to my bank and keep the others out?#

No. Every Bot on your account shares one cloud computer, with its files, browser sessions and command-line credentials, and the docs say not to treat separate Bots as a security boundary. Anything saved in Vault is also available to every Bot. Keep sensitive logins off Grok Bot entirely, or use a separate Cursor user, which gets its own computer.

Should I save my passwords in Grok Bot's Vault?#

Only low-stakes logins you would let any Bot use. Cursor's help says Bots never see saved passwords or card numbers, but every item is usable by every Bot, and there is no setting that forces approval before a saved card is used. For email, banking and admin accounts, typing the password on the Bot's screen yourself is the cautious route for now.

Do approvals from routines wait until I answer?#

No. Approvals raised by routines, triggers or other Bots expire after about 30 minutes according to the official docs and Cursor's help, and the action does not run. Turn on notifications for Bots that own routines so you see cards in time, rather than broadening Always allow rules to avoid the expiry.

How often should I review my Grok Bot setup?#

Weekly is a sensible rhythm. Check Settings, then Usage and Billing for consumption and the reset date, read the Permissions screen for Allow rules you do not recognize, and review Vault for items any Bot can now use. Update the app too, since recent releases changed approval behavior, payment options and several recovery messages.