What xAI’s own security docs say
The open-source CompanyOS
Whether Grok Bot is safe starts with one line from xAI: every Bot on an account shares one persistent computer, logins included, isolated per user. Kortix is an open-source CompanyOS, with one isolated sandbox per session. Connector credentials are brokered server-side and never enter the machine. That is the boundary to price.
Open source · A computer per session · Connector credentials brokered server-side
Every Grok Bot shares one persistent cloud computer.Your Bots share that machine (files, browser, logins),so they can hand work off and keep context.Isolation is per user, not per Grok Bot.https://x.ai/bot
A connector rule set to Ask holds the action until a person approves it.
Every Grok Bot cell is xAI’s own sentence, the three rivals repeat their READMEs, and Kortix is the open-source pick.
| Criteria | our pick | ||||
|---|---|---|---|---|---|
| What one job gets to itself | Its own cloud computer per session | One machine per user, shared by every Bot | Shared team computers, plus isolated private computers | Your own computer, under one Gateway | Its own computer for each bot |
| Where credentials sit | Connector credentials are brokered server-side and never enter the machine. | On the shared machine, with its logins | On the host you run it on | On your own hardware | Locally, in the bot’s apps |
| What holds an action before it runs | A connector rule set to Ask | Auto Review, plus Ask first rules | The computer it was given, private or shared | Policy in code, per its README | The bot’s own computer and connected apps |
| What a person reads after it runs | A change request on the Review page | The approval card; finished work stands | The bot’s conversation and history | The chat thread in its channel | The bot’s thread in the app |
| Which controls need Enterprise | Audit logs: Advanced RBAC and audit logs are on the Enterprise plan | Network controls, action recording, audit logs, DLP, SCIM | None; self-hosted, and in beta | None; no paid tier or hosted service | None named in its README |
| Where the record lives | The project’s git history, change by change | xAI’s audit logs, Enterprise only | The bot’s own history, on your host | Your own hardware; nothing is hosted | Locally, on the machine that runs it |
| Open source | Yes | No | Yes, Apache-2.0 license | Yes, MIT license | Yes, Apache-2.0 license |
Grok Bot cells quote x.ai and docs.x.ai, read October 31, 2026. Rival cells restate each project’s README and name where that project puts the control. No row here rates a product’s security; it locates the control.
Grok Bot's approval card is a real control. xAI describes its shape precisely: "An approval controls the proposed action. It does not reverse work already completed," the approvals documentation says. Auto Review checks an action before it runs. A card appears when the action needs a person: Allow to go ahead, Deny to stop it.
For a draft, that gate is the right shape. For a send, it stands in front of a door that closes behind the work. The invoice has gone, the email left the outbox, the row in the ledger changed. What a reviewer holds afterwards is a record of history.
Kortix splits the same duty in two. "A connector rule set to Ask holds the action until a person approves it," and session work reaches main through a change request, with merge default-deny for agents. One sits in front of a tool call. The other is the path every change to the project takes, so a skill an agent rewrote arrives as a diff a person merged.
Neither arrangement un-sends an email, and neither is meant to. What they decide is where the work stops. For a security review that is the thing worth comparing: what sits on the machine when the card appears.
The controls a regulated buyer asks about first sit on the Enterprise tier. xAI lists the organization-wide enable switch, Network Controls, Action Recording, Enforce Auto-review, audit logs, OpenTelemetry export, an MCP allowlist and SCIM as enterprise-only, and adds that "Self-serve Teams do not see those settings" (Grok Bot security).
It reads worse than it is. Encryption is not tiered: "Your cloud computer is encrypted in transit and at rest, with training opt-out," and enterprise administrators can set DLP, certificates, proxies and network controls at boot. A team on Premium gets the machine, the approval cards and the encryption. What it does not get is the evidence: the destination allowlist, the recording, the audit log, the ability to force Auto Review on everyone.
For a five-person team, that difference is a purchasing question rather than a security verdict. If a client's review asks who could have reached that mailbox and when, the answer needs the audit log, and the audit log needs Enterprise. The number to compare is the one xAI quotes for that tier, on top of the subscription tiers.
What none of those controls changes is the machine underneath them. Network Controls limits where a computer can send traffic, and audit logs record what happened there. The files, the browser session and the logins stay on one persistent computer per user, shared by every Bot on the account. xAI's product page describes exactly that arrangement. The unit to price is one machine, one set of logins, every job that user hands to a Bot.
What each one needs afterwards is something they can show a client.
Two clients
Both of a user’s Bots run on the same computer, so the second client’s work begins where the first client’s browser session ended. A computer per session keeps each client’s logins in a machine the other never opens.
Two clients, two machines
Access review
The answer is a change to what an agent may reach, merged by a person, so it carries a name and a date instead of a screenshot of a settings screen.
agents/support.md- connectors: [slack]+ connectors: [slack, zendesk]+1 -1
Merged by a person on the Review page
Before it lands
An agent that edits the project opens a change request, and a person decides on the merge, so a rewritten skill or a wider connector sits still until someone has looked.
| Change | What it touched | State |
|---|---|---|
| skills/invoices.md | the invoice playbook | waiting |
| agents/support.md | connectors | merged |
| memory/pricing.md | a client’s rates | waiting |
Two changes in review, one reviewer
Each answer stands on its own.
xAI documents approval cards, Auto Review, encryption in transit and at rest, a training opt-out and enterprise network controls, and says an approval does not reverse work already completed. What remains to price is the machine: every Bot on an account shares one computer, files, browser and logins.
Yes, when someone allows it. A Bot’s own work runs on the shared cloud computer xAI hosts, and with that permission it can also run commands on your Mac or Windows machine. Settings → Computer → Your computer sets it under “Execution on this computer”: “Ask every time”, “Always allow” or “Never allow” (xAI’s security docs).
xAI’s product page says your cloud computer is encrypted in transit and at rest, with training opt-out. Enterprise administrators can also set DLP, certificates, proxies and network controls at boot. Anything past that, such as the terms for a particular plan, is xAI’s to answer.
xAI. Grok Bot is xAI’s product, documented on x.ai and docs.x.ai and included with the Premium, Super, Ultra, Teams and Enterprise plans.
Start with one agent, one project and one person approving what merges.