Grok Bot now acts only as you, and keeps your passwords out of the model

A Grok Bot has no identity of its own. It acts as you, never with more access than you, and every action traces to a named person. Team-managed connectors are the one exception.

Slide text

Grok Bot now acts only as you, never with more access than you have

Access Never more than the member's own

Every action Attributable to a named member

Machine identity None to provision, rotate or audit

Exception: team-managed connectors may use team or service-account credentials

docs.x.ai/grok-bot/security · Identity and sign-ins

When a Bot uses a connected app, it calls the tool without ever receiving the OAuth token. Those tokens stay on Cursor's backend and are never stored on the Bot's computer.

Slide text

Connector tokens stay on Cursor's backend, never on the Bot's computer

01Bot calls a tool

02Cursor's backend holds the OAuth token

03Connected app answers

Tokens are never stored on the computer

docs.x.ai/grok-bot/security · Identity and sign-ins

To sign in, a Bot tries Vault, then a password manager like 1Password, then a Secure Form. The model never receives the password. For single sign-on or a passkey, it hands the computer to you.

Slide text

Passwords are filled into the page by reference, so the model never gets them

01Login saved in Vault

02Connected password manager, such as 1Password

03A Secure Form you fill in

Single sign-on and passkeys: the Bot hands you the computer

docs.x.ai/grok-bot/security · docs.x.ai/grok-bot/approvals-security-and-privacy

In Grok Bot app chats, a Bot can see a saved card's number and security code, to type at checkout. A saved card pays without asking each time, so to approve every payment, don't save it.

Slide text

In Grok Bot app chats, a Bot can see your saved card to pay at checkout

Bot can see Saved logins list, contact info

In app chats Card number and security code

Saved card Fills at checkout, no approval each time

To approve every payment, don't save the card

docs.x.ai/grok-bot/security · docs.x.ai/grok-bot/approvals-security-and-privacy

An API key goes in a secure secret card, masked and kept out of the transcript. Team Bots have no Vault, and take keys under Secrets. Never type passwords or one-time codes in chat.

Slide text

API keys go in a secure secret card, kept out of the chat and the model

API keys Masked secret card, hidden from the model

Team Bots No Vault; add keys under Secrets

Ordinary chat Never for passwords or one-time codes

docs.x.ai/grok-bot/security · docs.x.ai/grok-bot/vault