# Is Grok Bot safe? What an open-source alternative changes

> Whether Grok Bot is safe starts with one line from xAI: every Bot on an account shares one persistent computer, logins included, isolated per user. Kortix is an open-source CompanyOS, with one isolated sandbox per session. Connector credentials are brokered server-side and never enter the machine. That is the boundary to price.

URL: https://grokbotalternatives.com/grok-bot-security

What xAI’s own security docs say

**The open-source CompanyOS**

`x.ai/bot`

```
Every Grok Bot shares one persistent cloud computer.
Your Bots share that machine (files, browser, logins),
so they can hand work off and keep context.
Isolation is per user, not per Grok Bot.
```

Source: https://x.ai/bot

A connector rule set to Ask holds the action until a person approves it.

[Try Kortix](https://kortix.com) · [Compare the five](https://grokbotalternatives.com/#compare)

Open source · A computer per session · Connector credentials brokered server-side

## Five options on isolation, approvals and the record left behind

Every Grok Bot cell is xAI’s own sentence, the three rivals repeat their READMEs, and Kortix is the open-source pick.

| | Kortix (recommended) | Grok Bot | Rakazo | OpenClaw | OpenMausBot |
| --- | --- | --- | --- | --- | --- |
| What one job gets to itself | Its own cloud computer per session | One machine per user, shared by every Bot | Shared team computers, plus isolated private computers | Your own computer, under one Gateway | Its own computer for each bot |
| Where credentials sit | Connector credentials are brokered server-side and never enter the machine. | Tokens stay on Cursor's backend; the machine keeps files, browser and logins | On the host you run it on | On your own hardware | Locally, in the bot’s apps |
| What holds an action before it runs | A connector rule set to Ask | Auto Review, plus Ask first rules | The computer it was given, private or shared | Policy in code, per its README | The bot’s own computer and connected apps |
| What a person reads after it runs | A change request on the Review page | The approval card; finished work stands | The bot’s conversation and history | The chat thread in its channel | The bot’s thread in the app |
| Which controls need Enterprise | Every action is recorded. Reading, exporting and streaming the audit log depend on the plan. | Network controls, action recording, audit logs, DLP, SCIM | None; self-hosted, and in beta | None; no paid tier or hosted service | None named in its README |
| Where the record lives | The project’s git history, change by change | xAI’s audit logs, Enterprise only | The bot’s own history, on your host | Your own hardware; nothing is hosted | Locally, on the machine that runs it |
| Open source | Yes | No | Yes, Apache-2.0 license | Yes, MIT license | Yes, Apache-2.0 license |

Grok Bot cells quote x.ai and docs.x.ai, read October 31, 2026. Rival cells restate each project’s README and name where that project puts the control. No row here rates a product’s security; it locates the control.

## What an approval covers, and what stays standing

Grok Bot's approval card is a real control. xAI describes its shape precisely: "An approval controls the proposed action. It does not reverse work already completed," the [approvals documentation](https://docs.x.ai/grok-bot/approvals-security-and-privacy) says. Auto Review checks an action before it runs. A card appears when the action needs a person: Allow to go ahead, Deny to stop it.

For a draft, that gate is the right shape. For a send, it stands in front of a door that closes behind the work. The invoice has gone, the email left the outbox, the row in the ledger changed. What a reviewer holds afterwards is a record of history.

Kortix splits the same duty in two. "A connector rule set to Ask holds the action until a person approves it," and merge is default-deny for agents. One sits in front of a tool call. The other is the path session work takes: it reaches main through a change request, so a skill an agent rewrote arrives as a diff a person merged.

Neither arrangement un-sends an email, and neither is meant to. What they decide is where the work stops. For a security review that is the thing worth comparing: what stays off the machine when the card appears, and how far a running action can still reach.

## What enterprise-only means for a five-person team

The controls a regulated buyer asks about first sit on the Enterprise tier. xAI lists the organization-wide enable switch, Network Controls, Action Recording, Enforce Auto-review, audit logs, OpenTelemetry export, an MCP allowlist and SCIM as enterprise-only, and adds that "Self-serve Teams do not see those settings" ([Grok Bot security](https://docs.x.ai/grok-bot/security)).

It reads worse than it is. Encryption is not tiered: "Your cloud computer is encrypted in transit and at rest, with training opt-out," and enterprise administrators can set DLP, certificates, proxies and network controls at boot. A team on Premium gets the machine, the approval cards and the encryption. What it does not get is the evidence: the destination allowlist, the recording, the audit log, the ability to force Auto Review on everyone.

For a five-person team, that difference is a purchasing question rather than a security verdict. If a client's review asks who could have reached that mailbox and when, the answer needs the audit log, and the audit log needs Enterprise. The number to compare is the one xAI quotes for that tier, on top of the [subscription tiers](/grok-bot-pricing).

What none of those controls changes is the machine underneath them. Network Controls limits where a computer can send traffic, and audit logs record what happened there. Credentials are not what the disk keeps: "Connector tokens stay on Cursor's backend. Bots invoke tools without receiving OAuth tokens, and tokens are never stored on the computer," xAI's [security docs](https://docs.x.ai/grok-bot/security) say. What the computer does keep is working state, local files, browser sessions and anything saved in the browser, on a durable disk per user that every Bot on the account shares. The unit to price is one machine, one signed-in browser, every job that user hands to a Bot. Kortix moves that unit down to the session, so what one job leaves behind is not what the next job opens.

## Three readers with a security question

What each one needs afterwards is something they can show a client.

### Two clients: Two clients on one machine, and one login screen.

Both of a user’s Bots run on the same computer, so the second client’s work begins where the first client’s browser session ended. A computer per session keeps each client’s logins in a machine the other never opens.

What a review turns up: `Tuesday, two clients, one user`

- Client A session: own computer
- Client B session: own computer
- Logins shared between them: none
- Invoice sent from the wrong account: 0

Two clients, two machines

### Access review: A client asks who widened the bot’s access.

The answer is a change to what an agent may reach, merged by a person, so it carries a name and a date instead of a screenshot of a settings screen.

What a review turns up: `agents/support.md`

```diff
 agents/support.md
-  connectors: [slack]
+  connectors: [slack, zendesk]
```

+1 -1

Merged by a person on the Review page

### Before it lands: The change sits where a person can read it.

An agent that edits the project opens a change request, and a person decides on the merge, so a rewritten skill or a wider connector sits still until someone has looked.

What a review turns up: `review/queue.csv`

| Change | What it touched | State |
| --- | --- | --- |
| skills/invoices.md | the invoice playbook | waiting |
| agents/support.md | connectors | merged |
| memory/pricing.md | a client’s rates | waiting |

Two changes in review, one reviewer

## What people ask about Grok Bot’s security

Each answer stands on its own.

### How secure is the Grok bot?

xAI documents approval cards, Auto Review, encryption in transit and at rest, a training opt-out and enterprise network controls, and says an approval does not reverse work already completed. What remains to price is the machine: every Bot on an account shares one computer, files, browser and logins.

### Can a Grok bot control your computer?

Yes, when someone allows it. A Bot’s own work runs on the shared cloud computer, which xAI’s docs place on Cursor’s servers, and with that permission it can also run commands on your Mac or Windows machine. Settings → Computer → Your computer sets it under “Execution on this computer”: “Ask every time”, “Always allow” or “Never allow” ([xAI’s security docs](https://docs.x.ai/grok-bot/approvals-security-and-privacy)).

### Does Grok bot train on your data?

xAI’s product page says your cloud computer is encrypted in transit and at rest, with training opt-out. Enterprise administrators can also set DLP, certificates, proxies and network controls at boot. Anything past that, such as the terms for a particular plan, is xAI’s to answer.

### Who is behind the grok bot?

xAI. Grok Bot is xAI’s product, documented on x.ai and docs.x.ai and included with the Premium, Super, Ultra, Teams and Enterprise plans.

## One computer per job, one reviewer per change.

Start with one agent, one project and one person approving what merges.

[Try Kortix](https://kortix.com) · [See the alternatives](https://grokbotalternatives.com/grok-bot-alternatives)

An independent comparison of Grok Bot alternatives, taken apart part by part. Our pick is Kortix, the open-source CompanyOS.