Grok Bot Architecture: Shared Cloud Computer, Named Teammates, and Approval Boundaries

A Bot Is One Persistent Named Teammate

Think of a named coworker, not a chat box

Official docs say this in one line: a Bot is a single persistent, named agent — one AI teammate. You give it a short name, one job, and a description of how it should work. You message it the way you would message someone on your team. It keeps working after you close the laptop. It comes back when something needs your approval.

One catch-all helper is weaker than several focused Bots. The docs use jobs such as Talent Scout, Expense Manager, and Bug Reproduction. A job named “General Helper” gives the Bot less guidance.

Product unit, not a session

xAI’s Grok Bot overview (last updated 11 August 2026) defines the unit: in the docs and in the app, a Bot equals a single persistent named agent. It keeps memory, files, browser sessions, and preferences across turns. You work with it by messaging. You give it a task, context, and access. It can pass work to other Bots and only return when something needs approval.

The create-and-manage page (last updated 22 August 2026) is operational: create a separate Bot when the work has a distinct goal, tool set, working style, approval boundary, or recurring schedule. An account can have up to 50 Bots and group chats combined. Hiding a Bot removes it from the sidebar; it does not pause the Bot or its routines. Deleting a Bot removes its profile, conversation, and routines. Shared-computer files and sign-ins are not isolated by Bot and may remain.

Name

A short name. Example from get-started: Piper.

One job

One primary job. Example: product performance. Split roles later with New → Create new agent.

Description

How it should work, plus standing rules. Put “never send without approval” here, not only in one chat.

Durable state

Named Bots keep memory, files, browser sessions, and preferences. Context compounds instead of resetting every task.

One Shared Persistent Cloud Computer

One workshop. Many desks. One key ring.

Imagine a workshop that stays open all night. Every teammate on your account works in that same workshop. They share the drawers (files), the browser that is already signed in, and the keys hanging on the wall. Each teammate has their own desk and their own screen, so they can work at the same time. The desks are not locked rooms. If you put a password or a secret file in the workshop, every teammate can reach it.

The workshop belongs to your user account, not to one Bot. Closing the Grok Bot app or your laptop does not stop cloud work.

User-scoped VM, per-Bot screen

Computer-and-apps is the precise page. Every Bot on your account uses the same computer. Browser cookies and signed-in sessions are shared. Files are visible to every Bot. Command-line credentials are shared. One Bot can continue from work another Bot saved. The computer is assigned to your user account, not an individual Bot. Do not place a credential or file on it if another Bot on your account should not be able to use it.

Each Bot gets its own screen on that shared computer. Several Bots can use browser and desktop tools in parallel. One Bot can run only one computer-use task on its screen at a time. The screens are separate work surfaces, not separate security boundaries. Approvals (22 August 2026) repeats the rule: do not use separate Bots as a security boundary.

The overview’s marketing line is “it has a computer of its own.” The same overview, plus computer-and-apps, then define the topology: one user-scoped computer, shared files and sessions, per-Bot screens.

Cinematic still of one shared midnight workshop with several empty desks and one hanging key ring — Shared computer = one workshop. Each Bot = a named coworker with its own desk. Same key ring.

mermaid · shared VM vs per-Bot screen

flowchart TB
  subgraph account["User account"]
    subgraph vm["One persistent cloud computer"]
      workspace["/workspace files"]
      browser["Shared browser sessions"]
      creds["Shared CLI credentials and logins"]
    end
    botA["Bot A screen"]
    botB["Bot B screen"]
    botC["Bot C screen"]
  end
  laptop["Your Mac or Windows laptop"]
  botA --> vm
  botB --> vm
  botC --> vm
  laptop -.->|"separate; local policy"| vm

The security sentence

Treat a login or file placed on the computer as available to all of your Bots. Screens are not isolation. Deleting a Bot does not remove shared-computer files or browser sessions.

Connectors / MCP Versus Computer Use

A plug, or a pair of hands

Some apps have a clean plug. In the Grok Bot app those plugs are called Plugins. You add them under Settings → Plugins, sign in if asked, then type @ in chat to attach one to a task. Type / to use a saved skill.

Some apps have no clean plug. Then the Bot uses the shared computer’s browser and desktop, the way a person would click. Prefer the plug when one exists. Use the browser when there is no plug, or when the work is visual.

Structured path first, computer use second

Connectors give a Bot a structured way to work with supported services. They are shown as Plugins in the current app. Installed connectors are account-wide; their availability is not isolated to one Bot. In chat, @ attaches a connector. / references a saved skill. Skills docs also use @ for Bots, groups, routines, and connectors.

Prefer a connector when one is available: it is often more reliable than clicking through a website. Use the browser for services without a connector, or for visual workflows a connector does not expose. The overview names the same split: connectors / MCP where available, computer use for apps and websites without a clean API.

Cursor account integrations can start a routine from an event such as a Slack message or a GitHub notification. Official skills docs say those event triggers are separate from Slack or GitHub plugins and may require their own connection flow. That is not the same object as Settings → Plugins.

mermaid · connectors vs computer use

flowchart LR
  task[Task]
  task --> split{Supported connector?}
  split -->|yes · Settings Plugins| mcp["Structured connector / MCP"]
  split -->|no clean API| cu["Computer use · browser · desktop"]
  mcp --> tool[Work lands in the real tool]
  cu --> tool
  task --> skill["/ saved skill"]
  task --> mention["@ connector · Bot · group · routine"]

Start: Install, Sign In, Create, First Task

Five steps, then a real job

Install the Grok Bot app on a Mac or a Windows PC. There is no Linux desktop app. Sign in with Cursor. Create a focused Bot: name, one job, description. Give it a first task that names the outcome, the sources, the constraints, the deliverable, and when it should stop for you. When it hits a password, 2FA, CAPTCHA, or payment, you take over the computer. Do not paste secrets into chat.

Get-started path (last updated 20 August 2026)

You need an eligible plan (see Access; get-started’s list is shorter than the 26 August news page), the Grok Bot desktop app for macOS or Windows, and an app or website where the first Bot can do useful work. Grok Bot is not currently available as a Linux desktop app. iOS is a separate surface (iPhone, iOS 18 or later; not iPad or Android).

Grok Bot requires cloud data storage. Accounts using Legacy Privacy Mode must move to a supported Cursor data setting before Grok Bot can start. That mode is unsupported.

Install

macOS: Apple silicon or Intel disk image, drag to Applications. Windows: x64 or Arm64 installer. Updates are automatic; Check for Updates lives under Settings → Beta.

Get started, or Sign In with Cursor from Settings. Finish in the browser. SSO uses the organization flow. First-run questions shape teammate suggestions; they do not connect tools by themselves.

Create a focused Bot

Pick a suggested teammate or Create your own: short name, one primary job, description. Later: New → Create new agent, or Cmd/Ctrl+N then Create new agent.

First task shape

Outcome, sources, constraints, deliverable, review point. Then review Approvals before allowing external changes.

docs · first Bot profile · get-started

Name: Piper
Job: Product performance
Description: Investigate product-performance questions using our
observability tools. Preserve links and screenshots, separate
evidence from hypotheses, and return a short summary with the
highest-impact issue first. Never change production settings.

docs · first-task shape

1. Outcome     — What should be finished?
2. Sources     — Which apps, websites, files, or conversations matter?
3. Constraints — What must the Bot avoid or ask before doing?
4. Deliverable — What should it return?
5. Review      — When should it stop for you?

docs · five-minute first result · no connector

Summarize this document in five bullets. List every date, decision,
and open question in a separate section. Cite the page or section
for each item. Do not change the source file.

docs · first tool task · get-started

Open our analytics dashboard and compare new-user activation for
this week with the previous four weeks. Identify the largest
step-level change and draft a short investigation plan with links
to the relevant charts. Do not change any dashboards. Ask me to
sign in if needed.

docs · first handoff · overview

Pull this week's Strategic Prospects PG List from Salesforce.
Skip anyone already in a sequence. Research the top 5 accounts
across the web, Slack, Databricks, and Sumble, pull contacts,
and draft LinkedIn and email in my voice, and leave me drafts
to approve by tomorrow morning.

Agent Computer, Takeover, Secrets

You type the password. The Bot does not.

Open Agent Computer from the conversation to watch the shared desktop. You can leave the preview. Cloud work keeps going.

When a site asks for a password, a passkey, a two-factor code, a CAPTCHA, a payment, or a human check, the Bot should hand you the keyboard. You take over, finish only that step, then tell the Bot to continue. Do not paste passwords or one-time codes into ordinary chat. If a supported connection shows a secret-request card, type the value there. It is masked and is not added to the conversation.

Sensitive step is a human hop

The Bot may ask you to take over for a password or passkey, two-factor authentication, a CAPTCHA, a payment or identity check, or a site that explicitly requires a human. Open the computer, take control, complete only the blocked step, return control. Avoid pasting passwords or one-time codes into chat.

For a supported connection that presents a secure secret request, enter the value there. Approvals (22 August 2026): the value is masked, excluded from the transcript, and not shown to the model. It is not a general-purpose password manager.

Browser sessions persist so you usually do not sign in for each task. Because the browser is shared, signing in for one Bot makes the session available to your other Bots. Some sites expire sessions or re-verify. Ask the Bot to pause and notify you rather than attempting to bypass the check.

Cinematic still of a magenta approval lock and a secret-request card in front of a glass terminal — Takeover for password, 2FA, CAPTCHA, and payment. Secret-request cards, not chat paste.

/workspace, Temp Dirs, Update / Recover / Reset

Keep the real files in the shared drawer

The workshop has a shared folder called /workspace. Ask Bots to put lasting project files there, in clear project folders. Scratch folders, extra packages you installed by hand, and unsaved app state can be thrown away. Copy important results into /workspace or attach them to the chat.

Durable vs replaceable

The computer has a shared workspace at /workspace. Ask Bots to keep durable project files there. Files, browser state, and supported sign-ins are designed to survive normal computer updates and recovery. Treat temporary directories, manually installed packages, and uncommitted application state as replaceable.

Files-and-results: Bots can read files other Bots save in /workspace. The conversation should still contain the final result or a clear link to it. Desktop composer: up to six attachments at a time. Documents, images, and audio up to 25 MB each; video up to 200 MB. Encrypted, damaged, or unusual files may not be readable.

Control	Where	What official docs say
Recover computer	Error state	Use when the computer is unreachable. Recover Agent Computer preserves durable state when that action is offered.
Update Agent Computer	Settings → Beta	Rebuilds with the latest image while preserving durable state.
Recover Agent Computer	Settings → Beta / unreachable state	Replaces an unreachable computer while preserving durable state when offered.
Reset Agent Computer	Settings → Beta	Returns to the most recent durable snapshot and can discard recent unsaved or unsynced work. Last resort.

Least-destructive recover order

Troubleshooting: Retry or reopen → restart the app → Recover computer / Recover Agent Computer when offered → Update Agent Computer → wait → Reset only if recovery and update fail and you accept losing recent unsynced work. Wait for active work to finish before recovery when possible. App updates and Agent Computer updates are separate. Updating the desktop app does not reset the cloud computer.

Your Local Mac or Windows Computer Is Separate

The workshop in the cloud is not your laptop

The Bot’s computer lives in the cloud. Your Mac or Windows PC is a different machine. A Bot only runs commands on the computer in front of you when that capability is on and you approve it. The default is Ask every time. Use Never allowed unless a Bot has a real reason to touch local files.

Local execution policy

Path: Settings → General → Agent → Execution on Local Computer. Choose whether local commands always require approval, are always allowed, or are never allowed. The default is Ask every time. These settings do not prevent the Bot from using its cloud computer. Organization administrators can restrict local-computer execution. Available controls depend on the organization’s rollout and plan.

Troubleshooting: if local work is refused, review that same policy. Keep local access disabled unless the task specifically requires files or commands on the computer in front of you.

Skills, Routines From Demonstration, Schedules

Do it once. Save the recipe. Then set a clock.

A skill is a reusable set of instructions for how to do a task. A routine tells one Bot when to run a workflow — on a schedule or, where supported, after an event. Official order: start with a one-time task, make it reliable, save the method as a skill, only then automate it.

You can also teach a browser workflow by demonstration (Teach a task): up to ten minutes, no microphone, then review the draft skill. Test runs do real work. A Bot can own up to 50 routines. The app keeps the 20 most recent run records for each routine. Deleting a routine has no undo. Deleting a Bot also removes routines that Bot owned. Hiding a Bot does not pause its routines.

Skills page exists (fetched; not 404)

Skills are available across your Bots, although a Bot may need the relevant connector or login. Installed private skills can be enabled per Bot under Settings → Plugins → Yours. A useful skill states when to use it, required inputs and access, the sequence, how to validate, what to return, and what requires approval.

Teach a task records visible computer interaction for up to ten minutes. It does not record microphone audio. Avoid exposing secrets during the demonstration; use the secure handoff flow. The learned skill is a draft. Teach-by-demonstration may be enabled gradually. If the control is not visible, ask the Bot to create a skill from written instructions. Advanced teach-by-demonstration is not available on iPhone; use desktop.

Background routines can run while your laptop is closed. Event triggers (Slack / GitHub examples in the skills page) are separate from plugins. Avoid broad listeners such as “every new message.” A test run performs real work: it can navigate websites, change files, and call connected tools. Use safe inputs and keep write actions behind approval.

Editing schedule or instruction, viewing run history, testing, and deleting a routine currently require the desktop app. iPhone can inspect schedule, next run, and instruction, then pause or resume with Active.

docs · save a skill

Save the process we just used as a skill called “Weekly account health.”
Include the source systems, risk definitions, output format, and the
rule that customer contact always requires approval.

docs · create a routine

Every weekday at 8:00 AM, run the Daily customer-risk skill against
the current account list. Post a linked watch list in this conversation.
Do not contact customers. If the source data is unavailable, report
the failure instead of using old data.

docs · event trigger · not a plugin

When a message in #customer-escalations contains a support ticket
link and the phrase “needs repro,” open the ticket, reproduce the
issue in staging, and post a repro pack in this conversation.
Never post back to Slack without approval.

Approvals: Send, Publish, Pay, Delete, Prod

The Bot stops at the locked door

Tell the Bot which doors stay locked: sending messages, publishing, paying, deleting or overwriting, changing permissions, production changes, accepting legal terms. An approval controls the proposed action. It does not undo work already done.

On desktop you see Allow once, Deny, and Always allow. On iPhone: Approve once and Deny. If you cannot tell what the action will do, do not approve it. Ask for a draft first.

Request boundary, then Auto Review

Approvals, security, and privacy last updated 22 August 2026. Prefer explicit boundaries for sending messages or invitations, publishing, purchases and financial transfers, deleting or overwriting, changing permissions, production changes, and accepting legal terms.

When Auto Review enforcement is available: Settings → General → Auto-review. Require Approval rules always stop matching actions for you. Always Allow rules let matching actions proceed only when the automated review does not identify another reason to stop. If both kinds of rule match, Require Approval wins. Write narrow rules. Avoid “allow everything in the browser.” Auto Review is model-based and should complement, not replace, least privilege. Personal Auto-review rules are stored on the current desktop and synced to its Grok Bot computer. Verify them separately on another desktop installation.

mermaid · approval loop

flowchart TD
  req["Request names send / publish / pay / delete / prod"]
  req --> propose[Conversation shows proposed operation]
  propose --> ar{Auto Review if available}
  ar -->|"Require Approval matches"| stop[Stop for you]
  ar -->|"Always Allow and no other stop"| go[Proceed]
  ar -->|"both match"| stop
  stop --> human["Desktop: Allow once / Deny / Always allow"]
  human -->|Deny| block[Blocked]
  human -->|Allow once| go
  note["An approval does not reverse completed work"]

docs · boundary in the request

Reconcile the campaign data and draft a recommended budget change.
Do not change the campaign or message the agency. Ask for approval
after showing the current value, proposed value, and expected impact.

docs · narrow Auto Review examples

Require approval before sending any external email.
Require approval before changing a production dashboard.
Always allow running git status in /workspace/reports.

Least Privilege, Sign Out, Revoke Connectors

Official teardown order

When a project should end: pause or delete related routines, sign out of websites on the shared computer, uninstall connectors and revoke them in the source service, remove sensitive files from /workspace, hide or delete Bots that should no longer appear. Deleting a Bot is not the same as wiping the workshop.

Approvals page: connect only the tools a workflow needs. Use scoped service accounts where the source system supports them. Start with read-only tasks and draft outputs. Keep sending, publishing, purchasing, deletion, and production changes behind approval. Review installed connectors and active routines regularly. Pause a routine when its source system or expected workflow changes. Preserve source links and an action log for important decisions. Sign out of a service when it should no longer be available. Remove sensitive temporary files after the work is complete. Do not treat the user assignment of the computer as a guarantee broader than Cursor’s published security documentation.

Role Templates and Reviewable Results

Own an outcome, not a pile of questions

Official use-cases: Sales Outbound, Talent Scout, Paid Media, Expense Manager, Product Performance, Bug Reproduction, Account Health, Chief of Staff. Each starts with read-and-prepare work, then approved actions or a routine. Every starter prompt in that page ends with a stop: do not send, do not change budgets, do not contact anyone, do not change production.

Turn an example into a durable Bot

Use-cases order: put the job, source systems, output format, and standing boundaries in the description → run one real task with a safe scope → correct until reviewable → save as a skill → test on a second input → create a routine only when retries and failure cases are defined → keep consequential external actions behind approval.

Ask for a reviewable result: document with source links, spreadsheet with defined columns, slide deck with notes, folder of screenshots and logs, an unsent draft, or a short recommendation plus evidence. For consequential work, separate facts, assumptions, actions already completed, actions waiting for approval, and unresolved questions.

Desktop, iPhone, and What Is Not There

Surfaces the docs name

Desktop: macOS and Windows. No Linux desktop app. iPhone: iOS 18 or later; designed for iPhone, not iPad or Android. The iPhone app connects to the same Bots, conversations, routines, connectors, and shared cloud computer. Work continues in the cloud when the app is closed. Push delivery is still rolling out; in-app attention states remain available.

iPhone can create Bots and groups, take over the computer, pause or resume routines, install plugins, and configure Auto Review when available. Some advanced desktop controls and teach-by-demonstration are not on iPhone. Official docs also link to settings-and-notifications and chat-and-collaboration. This article does not invent those pages’ internals beyond what overview, bots, mobile, and skills already state (group chats, @everyone, passing context, time zone mentioned as a settings topic).

Access Dates: 11 August and 26 August 2026

Two official lists. Prefer the later news page for the expansion.

The 11 August 2026 news page (Introducing Grok Bot, early beta) listed Grok Bot for SuperGrok, SuperGrok Plus, SuperGrok Heavy; Cursor Pro, Pro+, and Ultra; and Cursor Teams Standard and Premium. It also said Grok Bot comes with its own usage, separate from Grok and Cursor plans, and that enterprise users can join a waitlist.

The 26 August 2026 news page (Grok Bot is now included with more plans) is the expansion. Prefer this page for who is included now: SuperGrok, SuperGrok Plus, SuperGrok Heavy, Cursor Pro, Cursor Pro+, Cursor Ultra, and Cursor Teams plans (Standard and Premium). Usage remains separate from Grok and Cursor plan usage. Enterprise waitlist remains.

Get-started (last updated 20 August 2026) and Grok Bot for iOS still list a shorter eligible set: SuperGrok Plus, SuperGrok Heavy, Cursor Pro+, Cursor Ultra, or Cursor Teams Standard or Premium. This article records both dates. It does not invent prices, SKUs beyond those names, or traffic numbers. Troubleshooting mentions that usage can be exhausted or an on-demand spending limit reached, and points at Usage & Billing when that section is available — still without published prices here.

Source	Date	Eligible set as written
x.ai/news/introducing-grok-bot	11 Aug 2026	SuperGrok, SuperGrok Plus, SuperGrok Heavy; Cursor Pro, Pro+, Ultra; Cursor Teams Standard and Premium
docs get-started + iOS	get-started last updated 20 Aug 2026	SuperGrok Plus, SuperGrok Heavy, Cursor Pro+, Cursor Ultra, Cursor Teams Standard or Premium
x.ai/news/grok-bot-more-plans	26 Aug 2026	SuperGrok, SuperGrok Plus, SuperGrok Heavy, Cursor Pro, Pro+, Ultra, Cursor Teams Standard and Premium

Key Takeaways

From official docs only

A Bot is one persistent named teammate. Name, one job, description. Focused Bots beat a catch-all.
One cloud computer per user account, not per Bot. Shared files, browser sessions, and logins.
Each Bot has its own screen, not its own security boundary. Do not use separate Bots as isolation.
Connectors (Plugins) first; computer use when there is no clean API. @ connector, / skill.
Start on macOS or Windows, sign in with Cursor, create a focused Bot. No Linux desktop app. Legacy Privacy Mode is unsupported.
Shape the first task: outcome, sources, constraints, deliverable, review point.
Take over for password, 2FA, CAPTCHA, and payment. Do not paste secrets in chat. Use secret-request cards.
Keep durable files in /workspace. Temp dirs are replaceable. Update / Recover preserve durable state; Reset can drop recent work.
Local Mac/Windows execution is separate. Default: Ask every time.
Skill, then routine. Demonstration up to 10 minutes, no mic. Test runs do real work. 50 routines per Bot; 20 recent run records.
Send, publish, pay, delete, and prod stay behind approval. Require Approval wins over Always Allow.
Sharing copies configuration, not the computer. Deleting a Bot does not wipe shared files.
Least privilege: sign out, revoke connectors, remove /workspace secrets, pause routines.
Access: prefer the 26 August 2026 news page for the expansion; get-started still lists a shorter set. Usage is separate from Grok and Cursor plans. Enterprise waitlist exists. No prices here.

Official Documentation

Primary sources used for this article

docs.x.ai/grok-bot/overview — last updated 11 August 2026
docs.x.ai/grok-bot/get-started — last updated 20 August 2026
docs.x.ai/grok-bot/computer-and-apps
docs.x.ai/grok-bot/approvals-security-and-privacy — last updated 22 August 2026
docs.x.ai/grok-bot/skills-routines-and-automations — fetched; exists (not 404)
docs.x.ai/grok-bot/use-cases
docs.x.ai/grok-bot/bots — last updated 22 August 2026
docs.x.ai/grok-bot/files-and-results
docs.x.ai/grok-bot/mobile
docs.x.ai/grok-bot/troubleshooting — last updated 11 August 2026
x.ai/news/introducing-grok-bot — 11 August 2026, early beta
x.ai/news/grok-bot-more-plans — 26 August 2026, access expansion

Official pages also link to settings-and-notifications, chat-and-collaboration, Cursor privacy, Cursor security, and third-party bot-sharing terms. This article does not invent APIs, prices, SKUs, certificates, traffic, or quotes beyond those pages.