Grok Bot

Record description

Grok Bot is xAI's agent product. Its documentation says Bots belonging to one user share a cloud computer, files, browser sessions and CLI credentials. Deleting a Bot does not erase that shared state. Named Bot roles therefore do not establish separate security principals. The product includes approval rules and model-based action review, which xAI describes as a complement to least privilege rather than a guarantee. These are documented design boundaries, not findings of cross-user access or a successful exploit. OpenClaw documents an analogous boundary at the gateway level, recommending separate gateways and credentials for mutually untrusted users. The shared lesson is to identify the actual credential owner behind each agent role.

Explicitly related research (1)

Declared connections