Grok Bot Security

What's isolated and what isn't

So: if a Bot handling untrusted input (inbound email, web research) gets tricked, it can use the logins your finance Bot relies on. To isolate work, use a separate account, not a separate Bot.

Credentials

• Connector tokens stay on Cursor's backend and are never stored on the computer. Prefer connectors.
• For passwords, 2FA codes and CAPTCHAs the Bot hands the computer to you (computer takeover) instead of typing them. Never paste a password into chat.
• Browser logins persist on the durable disk. Sign out of anything a Bot no longer needs.
• Webhook routine URLs and keys are credentials. Store them like API keys and rotate them if exposed.

Approvals: Auto-review and rules

• Auto-review checks Bot actions against what you asked for. It covers shell commands, plugin calls, computer use, automation writes and delegation. It does not review memory writes or most settings changes.
• You can add "Ask first" rules (always stop) and "Allow automatically" rules. Start with Ask first for sending, purchasing, deleting, publishing and changing production systems.
• On Enterprise, admins can enforce Auto-review so members can't turn it off.
• Local execution (running things on your own machine) uses per-command approval by default. xAI recommends "Never allow" unless you specifically need it.

Network

• Policy modes: No Policy (Allow All), Defaults + Team Allowlist, Team Allowlist Only.
• Outbound traffic uses shared static egress IPs by default, shared across customers, so don't allowlist those IPs as if they were yours alone.
• Members can optionally route traffic through their desktop to use its network.

Data and privacy

• Computers run in the United States. Grok Bot requires cloud storage (Legacy Privacy Mode isn't supported).
• With Privacy Mode on, your data is not used for training and model providers keep zero retention. Providers may still run abuse classifiers, and flagged data may be stored for investigation.
• Daily encrypted backups. Under the DPA, data is deleted or returned within 30 days of written direction after service ends.
• Anysphere (Cursor) holds ISO/IEC 27001 and ISO/IEC 42001 certifications.

Prompt injection

Outside content is marked as untrusted when shown to the model, and Auto-review, network policy and per-action approvals add layers. xAI's docs say these reduce, but do not eliminate the risk. Any Bot that reads email, web pages or shared documents can be handed instructions by whoever wrote them. Our general guide: security center.

Hardening checklist

1. Put every Bot's permanent "never" rules in its description, not in a message.
2. Add Ask first rules for send, purchase, delete, publish and production changes.
3. Use connectors over browser logins, and give Bots their own email identities rather than yours.
4. Keep Bots that read untrusted input on a separate account from Bots that hold sensitive logins.
5. Set local execution to Never allow.
6. Store webhook URLs and keys as secrets, and filter each webhook to its intended source.
7. Review routine run history weekly. Only the last 20 runs are kept.
8. On teams: enforce Auto-review, use Team Allowlist network policy, and stream audit logs to your SIEM.