Independent, unofficial guide written by everyday users · Not part of or affiliated with SpaceXSI (formerly xAI) · New to Grok? Start at GrokExplained.com
GrokBotExplainedPlain-English Bot guides · Unofficial
Beginner guide · Printable

Keeping Your Bot Safe

Facts last checked October 20, 2026 · About a 6-minute read

One of the things we love most about Grok Bot is how much it can take off your plate. The good news is that it's built so you stay in charge of the important steps. These simple habits let you enjoy all that help with real peace of mind.

Or press Ctrl+P (Cmd+P on a Mac). Printing uses large type and leaves out the menus.

Our Five Golden Rules

  • 1. Tell your Bot where to stop before it starts.
  • 2. Read every approval card before you tap anything.
  • 3. Type your own passwords and codes, never in the chat.
  • 4. Keep money and messages behind your approval.
  • 5. Tidy up when a job is done.

These rules are our own summary of the official guidance below.

1. Tell Your Bot Where to Stop

The official guide says the best place to set a limit is right in your request: say what the Bot may do, and where it must stop and ask you.[1] It suggests clear limits for:[1]

  • Sending messages or invitations
  • Publishing anything
  • Buying things and moving money
  • Deleting or overwriting things
  • Changing permissions
  • Accepting legal terms

Here's a sentence you can add to the end of any request (our own wording):

"Do not send, post, buy, pay, or delete anything. Make a draft and ask me first."

You can also put your standing rules in each Bot's description, so the Bot remembers them every time.[2]

2. Read Every Approval Card

When a Bot wants to do something that needs your okay, it shows you a card with what it plans to do. Check what it's acting on and what will change, then choose:[1]

  • Allow once: the Bot goes ahead with just this one action.[1]
  • Always allow: saves a rule so similar actions go ahead next time.[1]
  • Deny: stops it.[1]

The buttons are the same on iPhone.[1]

  • Not sure what it means? Don't approve it. Ask the Bot to explain in plain language, or to make a draft first.[1]
  • Approvals don't undo things. An approval controls the next step. It doesn't reverse work that's already done.[1]
  • Some cards expire. A request from work that started without you, such as a routine, expires after about 10 minutes and the action doesn't run. Just ask the Bot to try again.[1]
Our advice: while you're learning, choose Allow once rather than Always allow. Deny is always a safe choice while you think it over or ask someone you trust.

Want a permanent safety net? Under Settings, then General, then Auto-review, you can add "Ask first" rules, such as "Ask first before sending any external email." Ask first rules always stop matching actions for you.[1] The official guide recommends narrow rules, and says to avoid broad ones like "allow everything in the browser."[1]

3. Type Your Own Passwords and Codes

For passwords, passkeys, two-factor codes, the "I'm not a robot" puzzles called CAPTCHAs, and payment confirmations, the Bot should hand control to you:[1]

  1. Choose Take over on the request in the conversation.[1]
  2. Type the password or code yourself.[1]
  3. Choose I'm done, then tell the Bot to carry on.[1]

You can do this from your phone too.[5] Never send a password or one-time code in the ordinary chat.[1] And if a website puts up a puzzle or asks for a human, the Bot should hand that step to you rather than trying to get around it.[2]

4. Keep Money and Messages Behind Your Approval

Grok Bot keeps getting more capable, which is exciting. In September 2026 the official Grok Bot account announced a Finance feature that links bank, card, and investment accounts so Bot can help with spending and investments.[7] In October it announced that Bot has its own email, which it can use to sign up for services, contact businesses, or schedule time with someone.[8]

Those are wonderful helpers. Our advice for beginners is to go gently:

  • Start with reading and drafting. The official guide suggests starting with read-only tasks and drafts, and keeping sending, publishing, buying, and deleting behind your approval.[1]
  • Connect only what a job needs. Add one connection at a time, and only when a job really needs it.[1]
  • Read every email before it goes. When a Bot prepares an email, the phone app can show you a draft to edit, with Send or Discard.[5]
  • Ask a family member first (our advice) before you approve anything that involves your bank, bills, or money for the first time.

Good Things to Know

  • Your Bots share one computer. All of your Bots use one cloud computer, so a website you sign in to for one Bot can be used by the others. The official guide says not to treat separate Bots as a security wall.[1][2]
  • Your own computer is separate. Whether a Bot can work on the computer in front of you is its own setting. The default is Ask every time, and the official guide suggests Never allow unless a Bot has a specific reason to work on your files.[1]
  • Web pages can contain sneaky instructions. Content a Bot reads, like a web page, can try to steer it. Grok Bot has protections for this, but the official security page says they reduce the risk rather than remove it. That's one more reason to keep important steps behind your approval.[3]
  • Sharing a Bot shares its setup, not your logins. A share link lets others copy a Bot's setup, but not your computer or logins. Still, don't put private details in a Bot you share.[1]
  • Your data. The official product page says your cloud computer is encrypted in transit and at rest, with a training opt-out.[6]

5. Tidy Up When a Job Is Done

When a project is finished, or you no longer want a Bot to reach something, the official guide lists these steps:[1]

  1. Pause or delete any routines that use it.
  2. Sign out of websites on the Bot's computer.
  3. Remove the connection, and also turn off its access in the other service itself.
  4. Remove private files the Bot no longer needs.
  5. Hide or delete Bots you don't need anymore.

Good to know: deleting a Bot doesn't remove files or website logins on the shared computer, so do the other steps too.[1]

Staying Clear of Scams

  • Get Grok Bot only from x.ai/bot or the official app store listings.[4] Our download guide shows how to check.
  • Subscriptions are sold only directly, never through resellers.[9]
  • Our advice: if anyone asks for your password or a code by email, text, or phone, stop and go to the official site yourself. We're a fan site, and we will never ask for your login.

Take it one step at a time, and enjoy it. With these habits in place, you can hand your Bot real work and feel good about it.

What to Read Next

Sources

Every fact above comes from these official pages (tips marked "our advice" or "our wording" are our own), checked on October 20, 2026. Grok Bot changes often, so if something looks different on your screen, the official page wins.

  1. Approvals, Security, and Privacy, official Grok Bot docs (last updated October 12, 2026): https://docs.x.ai/grok-bot/approvals-security-and-privacy
  2. Frequently asked questions, official Grok Bot docs: https://docs.x.ai/grok-bot/faq
  3. Grok Bot security, official docs: https://docs.x.ai/grok-bot/security
  4. Get Started, official Grok Bot docs (last updated October 12, 2026): https://docs.x.ai/grok-bot/get-started
  5. Grok Bot for Mobile, official Grok Bot docs: https://docs.x.ai/grok-bot/mobile
  6. Grok Bot product page: https://x.ai/bot
  7. Official Grok Bot post on X about the Finance integration (@bot, September 26, 2026): https://x.com/bot/status/2103936247995752705
  8. Official Grok Bot post on X about Bot's own email (@bot, October 9, 2026): https://x.com/bot/status/2108609764766908772
  9. Official pricing page: https://x.ai/pricing