Grok Bot: The New Wave of AI Agents
By Veer Solanki · · 1076 words
Topics: AI, Administrative Automation, Agent Security, Agentic AI, Agentic AI Systems, Agentic Automation, Agentic Workflows, AI Adoption
xAI rolled out Grok Bot in beta on August 11. Their positioning is not timid – these are not assistants. These are teammates, to which you give a name, say what to do, and they make work while you sleep.
Grok Bot instances get their own cloud where Chrome, File Manager, and Terminal run.
They log in to your accounts and click around, as you would, returning when they need to make a decision, otherwise working independently.
You don’t design a flow for a Bot; you work alongside them once, and it captures notes, subsequently triggering actions on a schedule or in response to occurrences. You can run multiple Bots at once, with a shared chat workspace for collaboration.
Grok Bot subscriptions come with existing products – SuperGrok Heavy, Cursor Ultra, and Cursor Premium Teams. It is available on desktop and iOS; enterprises have to wait for a launchpad.
Grok Bot came out three days after SpaceX announced a $60 billion all-stock buyout of Cursor that will merge the product into a new division called SpaceXAI. Grok Bot and Grok Build now live in the same product tree with Grok API and Cursor.
That is the public narrative. This is the reality.
Four companies built the same product in one quarter.
Claude Cowork. ChatGPT Work. Copilot Cowork. Grok Bot. Same recipe, same quarter, same press release text about giving access to apps, telling what to do, making work while you wait
When four research teams discover the same product in one quarter, we know that someone has seen something everyone else has, but no one has seen something worth having. There is no moat; the moat was created at the model layer, not the product layer. Each company realised that emergent agents were coming at the same time, and each raced to build a UI around the same set of capabilities.
That makes all of them realise that the distribution channels are where any battles will be fought. xAI has already made a crucial mistake by distributing Grok Bots as add-ons to other products. Users do not buy a bot, but subscribe to a more expensive plan that hides the bots in the account settings. That is the cheapest possible way to acquire a customer, and all customer acquisition metrics should be taken with a grain of salt lick. When you bundle one product with another, you cannot claim that the acquisition cost of the first is lower than it would be otherwise; you have to assume that no one wanted it, hence why it is there.
“Works with apps that don’t have an API” is vaporware.
xAI likes to position Grok Bot as something that can work with apps that do not have an API. Read that sentence again. That is not vaporware positioning; it is an outright attack on the competitive differentiation of the entire agent category. The way you monetise emergent agents is to make them work with apps that do not have an API. The reason is that you cannot write code against an API that does not exist.
Browser automation is what we use when the APIs are closed; it always has errors, and it always will, and all we did was push mistakes further up the stack. When a vendor decides to change the way a page looks, your coworker Bot silently starts clicking buttons that do not exist and stops looking for data on pages that do. All agent vendors know this, which is why they all ship the same feature, and none of them talks about the gaping hole in their positioning. The ability to work with an application that does not have an API is vaporware; the reality is that your agents will work best with the apps your developers wrote APIs for, and that audience is much narrower than xAI would have you believe.
Security surface = threat model
Read the features list as an attacker.
A persistent VM instance. A browser with saved sessions. A terminal. Persistent access to CRM, emails, and internal tools. A decision-making engine executing untrusted text from every other site it browses, with no ability to separate content from instructions.
This is incredibly valuable context to have when building a prompt injection attack, which is the canonical attack vector for all browsing agents. Giving the agent a terminal does not make it more secure; it makes the surface for an attack larger and the impact of a successful one worse. The injected prompt will have to navigate the environment to reach the terminal, but approval fatigue is a well-documented phenomenon, and all the value propositions are predicated on the idea that users will not notice. xAI has not published a threat model, and neither have any of the other agent vendors.
The claim that’s being made
Look at the use cases that xAI published for Grok Bot. Bots that keep CRM data clean. Bots that process invoices in Gmail. Bots that seat new employees. Even bots that replicate UI bugs and turn them into tickets, subsequently routing those tickets to another Bot for resolution.
These are all jobs. Not tasks within jobs, entire jobs, usually held by someone on the operational or administrative staff, costing the company $120 to $200 per month.
This is the claim that all agent vendors are making, buried under light positioning about Bots and teammates. This is where the discussion of roles is valuable; it is not to make you feel better about the fact that an AI is doing the work of your secretary, but to extract value from the person who has to watch it do so. When you replace a person with an agent, you reduce your costs; you are already seeing that happen.
What to watch
Not the demos. The demos are nice, but you want to focus on three things.
Can the recorded actions be replayed if one of the SaaS vendors changes their interface? This is the product durability test, and it rarely lasts more than a few months before becoming public knowledge.
Is there a critical prompt injection bug in an agent that also has access to a terminal? The response to that one bug will define the category.
Does anyone renew? You can disregard the figures for now, but if you ship a product that replaces people, the retention rate will tell you everything.
The teammate positioning is doing a lot of work. So is the beta label.