Grok Bot — Cursor Pro+ Ships a Credential-Holding Agent

Four days ago SpaceXAI pushed Grok Bot — an autonomous agent that signs into your apps, operates end-to-end, and returns only when it needs approval — from its premium-only beta to every Cursor Pro+ subscriber and all Cursor Teams seats. The headline from the SpaceX/Cursor acquisition has always been model lock-in. The real story arriving right now is governance lock-in. Most Cursor Pro+ subscribers signed up for an IDE. They did not opt into a general-purpose computer-using agent that holds their credentials and acts on their behalf while they sleep. I would treat this as a security triage event before a feature evaluation. Know which accounts Grok Bot can reach before you hand it any.

TL;DR

• What: Grok Bot expanded Aug 21 from three premium-only plans to all Cursor Pro+ ($60/mo), Cursor Ultra ($200/mo), and both Cursor Teams tiers — announced via X post only
• Architecture risk: All Bots in your account share one persistent cloud computer — not isolated per-Bot machines as the launch page claims
• Cost risk: No Grok Bot-specific spend cap; overage bills at Grok 4.6 rates ($2/$6 per million tokens, doubling above 200K)
• Action: Audit which services Grok Bot can access in your account before enabling it; enterprise orgs should stay on the waitlist until isolation guarantees exist

Grok Bot Expansion — What Happened

On August 11, SpaceXAI launched Grok Bot in closed beta for SuperGrok Heavy, Cursor Ultra, and Cursor Teams Premium subscribers. Ten days later, on August 21, they expanded access to SuperGrok Plus ($100/mo), Cursor Pro+ ($60/mo), and Cursor Teams Standard ($40/seat) — covering every paid Cursor tier except Enterprise, which remains on a waitlist. The announcement shipped as a single X post. No release notes. No documentation entry. No blog post. For a product that holds user credentials and operates autonomously, announcing via social media is a governance decision in itself.

Each plan includes a weekly Grok Bot usage allowance. After exhausting it, billing continues on-demand at Grok 4.6 token rates: $2 per million input tokens and $6 per million output tokens below 200K prompt tokens, doubling to $4/$12 for requests above that threshold. There is no Grok Bot-specific spend ceiling. The only hard stop is running out of money.

The underlying model, Grok 4.6, launched August 12 with a 500,000-token context window — built explicitly for long-running agentic tasks. SpaceXAI has not officially published its parameter count; the widely reported 1.5-trillion figure traces back to third-party analysis, not company materials. More importantly, Elon Musk confirmed that Grok 4.7 — a 2.1-trillion-parameter successor — is expected within weeks. When it ships, the model underneath Grok Bot will change without a plan version bump. You will not get a changelog. You will get different behavior.

Why This Matters

The architecture is the story here, not the model benchmarks. SpaceXAI’s launch page says each Bot gets its own computer. Their own documentation says the opposite: all Bots in an account share one persistent cloud computer, and separate Bots should not be treated as a security boundary. This is not a nuance — it is a material contradiction between marketing and the actual security model.

SpaceXAI’s docs explicitly state: “All of your Bots share one persistent cloud computer, and separate Bots should never be treated as a security boundary.” The launch page claims each Bot gets its own computer. The docs win. Plan your threat model accordingly.

What this means in practice: if you run three Bots — one for email triage, one for Jira management, one for code review — they all share a machine. A credential leak in one context is a credential leak in all three. There is no documented isolation primitive between them. For a solo developer, that risk might be acceptable. For a team of fifteen sharing a Cursor Teams Standard plan at $40/seat, it means every team member’s Bots cohabitate on shared infrastructure with no published audit trail for agent actions.

The timing matters. The SpaceX acquisition of Anysphere closed on August 14 — one week before this expansion. Grok Bot’s entitlement structure routes through Cursor subscription tiers, not standalone xAI plans. That is the clearest public signal that SpaceXAI and Cursor are shipping as a single entity. Enterprise procurement teams that assumed they were buying an IDE are now receiving an autonomous credential-holding agent as a bundled feature, and the only documented opt-out is enabling Cursor Privacy Mode (Legacy), which disables Grok Bot entirely. Organizations that have migrated to Cursor’s newer privacy controls do not have this escape hatch.

Compare this to how other agent platforms handle credential scope. Claude Code runs in your terminal with explicit tool-use approval gates. GitHub Copilot’s agent mode operates within the editor’s sandbox. Neither signs into your inbox or your project management tool. Grok Bot does. It operates across apps and websites that have no API or MCP surface — meaning it is using your browser sessions, not programmatic integrations you can audit or revoke granularly.

If your team uses Cursor Teams, check whether Grok Bot is enabled by default in your plan. The expansion shipped with no org-admin toggle documented outside of Privacy Mode (Legacy). If your org has already migrated off Legacy privacy controls, you may have no disable mechanism.

The cost model compounds the governance gap. With no per-Bot spend cap and no model picker to steer requests toward cheaper alternatives, a Bot left running overnight on a complex task can burn through its weekly allowance and keep billing at full Grok 4.6 rates. At $6 per million output tokens with a 500K context window, a single aggressive research loop could generate meaningful charges. Teams plans offer spend alerting via Slack or email, but alerts are not caps — they notify after the fact.

Enterprise customers cannot even evaluate this risk firsthand. Enterprise access requires joining a waitlist through Cursor account teams. The organizations with the strictest security requirements are the last to get hands-on access, while every $60/month Pro+ subscriber already has the keys.

The Take

I keep returning to a simple question: who asked for this? Cursor’s value proposition was always the editor — fast, smart, context-aware coding assistance. Grok Bot is a different product category entirely. It is a general-purpose autonomous agent that happens to be bundled with your code editor subscription. The shared-computer architecture, the missing spend caps, the announcement-by-tweet, the contradictory isolation claims — these are not bugs in an otherwise sound rollout. They are symptoms of a product that shipped on an acquisition timeline rather than a security readiness timeline.

If you are on Cursor Pro+ or Teams, here is what I would do today: audit every service Grok Bot can reach from your account. Assume zero isolation between Bots. Set up spend alerts at aggressively low thresholds. And if you are on an Enterprise plan, stay on that waitlist until SpaceXAI publishes actual per-Bot isolation guarantees — not marketing copy, documentation.

The credential-holding agent pattern is coming to every IDE eventually. But shipping it as a silent expansion to millions of existing subscribers, with contradictory security documentation and no org-level controls, is not how you earn trust for that transition.

Related

• Cursor-SpaceX Acquisition Close: Origin and Model Lock-in — The acquisition mechanics and what “single entity” means for your model choices
• Grok Build: Repo Exfiltration and Credential Rotation — Earlier credential risks in the Grok ecosystem
• Grok 4.5 Cursor Data Model Launch — How Cursor session data trained the model now powering the agent that holds your credentials