What is shared, officially

The overview is explicit: an account has one cloud computer, and Bots work on it with a browser, a file system, and a terminal. Bots sign into your apps with your real logins, and Cursor's help adds that once you sign in, every Bot on your account can use that sign-in until it expires. Approvals and ask-first rules govern what a Bot does, not which Bot can see what. A shared Bot link copies profile, skills, and routines, but recipients never get your computer, logins, or history. The FAQ on x.ai/bot, read October 25, puts it the same way: every Grok Bot shares one persistent cloud computer with its files, browser and logins, and isolation is per user, not per Bot.

So a Bot named Finance and a Bot named Marketing are two roles on one machine. Treat everything the computer is signed into as reachable by every Bot, and design your access accordingly. A Cursor staff member said on October 2 that letting an individual Bot keep its own browser session is something the team is actively working on; until it ships, Is Grok Bot safe? covers how to set up around the shared session.

Documentation: Grok Bot overview ↗ Approvals, security and privacy ↗ Cursor help: how-tos (shared sign-ins) ↗ Forum: Bots are not a security boundary (staff reply, October 2) ↗ Grok Bot FAQ on x.ai/bot (one shared computer, isolation per user) ↗

Why browser logins disappear

Community reports from mid-August describe Chrome profiles on the shared computer resetting daily, so sites that were signed in yesterday ask again today. The official troubleshooting page covers the symptom rather than the cause: take over, sign in manually, complete two-factor or CAPTCHA yourself, confirm the page loaded, and tell the Bot to continue. It also notes that some sites expire sessions or require verification for each sensitive action, which is not always avoidable even with a plugin. Never paste a password or a verification code into the chat.

Practical consequence: prefer plugins over browser sign-in wherever a plugin exists. Plugins are managed in Connect Apps (called Marketplace before version 0.67.0), not in Settings, and the Teams documentation says plugin OAuth tokens stay on Cursor's connector backend rather than in the shared browser, so they do not depend on a cookie that may expire. When a page needs you to type something yourself, the approvals guide says the Bot can show a Secure Form in the chat and fill your answers into the page, and the same page describes hardware security key support on macOS and Windows. For passwords, read the next section first: until Cursor ships a fix, type them on the computer yourself. Our plugins guide covers installing and authorizing plugins.

X is a common case. In a forum thread opened August 16 that has passed 600 views, a user reported that after the Bot repeatedly submitted their X login from its computer, X answered We've temporarily limited your login there, and the limit did not lift after a day, while the same account signed in normally on their own devices. A Cursor staff member replied on August 17 that the team is aware of the issue and tracking it, and suggested trying a new agent and signing in yourself rather than asking the Bot to; another user later got in by fully closing Chrome on the Bot's computer and clicking the Google login themselves. Another user reported the same block on October 21 and asked for a workaround; none had been posted when we checked on October 25. The 0.75.5 release notes (October 23) offer a route around the browser: asking a Bot about your X account connects X through your linked X account, even if you removed the X plugin, and 0.71.2 says Bots now hit X's rate limit less often. Two 0.77.0 fixes (October 26) should also help logins last: the Bot's browser keeps site logins after its last window closes, and keys that apps on the computer store in the system keyring, such as Okta Verify's, now survive when the computer is recreated.

Some sites refuse the Bot's browser outright rather than forgetting it. A forum thread opened September 2 asking for a Grok Bot Chrome extension, past 750 views by October 28, collected examples: QuickBooks blocking a Bot after two weeks of reconciliations, geo-restricted stores that do not load, and marketplace accounts that demand a fresh sign-in several times a day. A Cursor staff member (deanrie) answered each. There is no extension and the Bot cannot control your local Chrome or your signed-in tabs, because everything runs on its cloud computer; the request has been passed on with no timeline. For a site that flags the cloud browser as automated traffic, use a connector or a custom MCP server where one exists, since those talk to the service's API and skip browser checks, and vote for a native connector where there is none. For a site that blocks by location or IP, open Settings → Computer in the desktop app and turn on Route traffic through this computer, so the Bot's browser traffic leaves through your own network and IP; staff said on October 26 it is usually the first thing to try, with no guarantee, because some sites block automated browsers whatever the IP. The docs' private networks page describes the setting. Since 0.78.1 (October 27), with Route traffic through this computer on, Settings says when the Bot's computer is asleep and that routing reconnects when it wakes, and pages no longer fail right away when only another host on them is refused. The same entry says that when the Bot's computer has been refusing saves, Reset and Recover keep the current disk instead of restoring an older backup, and that files already saved in another chat, such as Slack uploads to a Shared Bot (formerly Team Bot), save in the new chat instead of failing.

Documentation: Grok Bot changelog: 0.78.1 (Route traffic sleep notice, Reset and Recover keep the current disk, October 27) ↗ Official troubleshooting ↗ Settings: plugins live in Marketplace ↗ Teams and enterprises: plugin tokens ↗ Approvals, security and privacy ↗ Connect to private networks (Route traffic through this computer) ↗ CellCog problems tracker ↗ Forum: X login limited on the Bot's computer (630 views, staff reply August 17, new reports October 21) ↗ Forum: Grok Bot Chrome extension request (staff replies on sites that block the cloud browser, September 12 to October 26) ↗ Grok Bot changelog 0.75.5 (October 23): Vault, X through your linked account ↗ Grok Bot changelog 0.71.2 (October 14): Secure Form, wake in place, 1Password-free actions ↗ Grok Bot changelog: 0.77.0 (browser keeps site logins, Import Memory, Route traffic fixes, October 26) ↗

Passwords: skip the Secure Form for now (October 2026)

On October 5 a user reported that after the in-chat Secure Form filled a GitHub username and password into the Bot's browser, the snapshot the Bot took before clicking Sign in showed the password in plain text. That put the password into the session's tool output and transcript, although it never appeared in chat. A Cursor staff member replied the same day that a password filled by the Secure Form should not show up in a page snapshot, that the team was already working on a fix, and that the safest way to sign in until it ships is to do it yourself on the Bot's screen.

The Grok Bot 0.68.1 changelog on October 7 changes where Secure Forms fill, but it does not mention snapshot redaction, and neither do the notes for 0.69.0 to 0.70.2 on October 11. A user asked in the thread on October 7 to be told when it is fixed; Cursor had not posted an update when we checked on October 25. The later release notes do not mention snapshot redaction either: 0.71.2 (October 14) says Bots now ask for logins and other multi-field details on one Secure Form and that the form fills fields on more websites, including embedded frames, and 0.75.5 (October 23) adds a Vault in Settings where Bots save your logins, cards and contact info and fill them in to sign in or check out. Neither note says whether filled passwords are kept out of page snapshots, so treat the issue as open. Separately, staff described a known issue on September 30 where 1Password autofill on some login pages, including Instagram and Letterboxd, reports Filled while the password field stays empty, and on October 10 said the Google password step cannot be filled from 1Password on the full page either, not just in the popup. Their workaround is the same: when the Bot hands you the screen, type the password from 1Password yourself, finish two-step verification, and hand control back; the Bot's browser usually keeps the Google session afterwards.

One 1Password problem now has a server-side fix. In a 344-view thread about the 1Password connection failing with a message that the credential delivery outcome was unknown, a Cursor staff member (Colin) explained on September 27 that a single login with an extremely long website address, over 2,000 characters, was blocking the whole connection, and gave a workaround: shorten that item's website to the site's normal address, fully quit Grok Bot with Cmd+Q, and click Connect 1Password again, then delete the leftover Grok Bot agents service accounts each failed attempt created, under Developer, then Service Accounts on 1Password.com. On October 20 he wrote that this is now fixed on Cursor's side: the oversized address is skipped, it no longer blocks the connection or the background sync, and no Grok Bot update is needed. If the connector still fails, he asked for the exact message and roughly how many items the shared vault holds. Separately, 0.71.2 says screenshot, computer and browser actions keep working when you haven't connected 1Password.

Documentation: Forum: password filled by the Secure Form shown in a page snapshot (staff reply, October 5) ↗ Forum: 1Password autofill says Filled but the password stays empty (staff reply, September 30) ↗ Forum: Grok Bot will not log in to Google with 1Password (staff replies, September 30 and October 10) ↗ Forum: Grokbot and 1Password, long website addresses (staff workaround September 27, server-side fix October 20) ↗ Grok Bot changelog ↗ Grok Bot changelog 0.71.2 (October 14): Secure Form, wake in place, 1Password-free actions ↗ Grok Bot changelog 0.75.5 (October 23): Vault, X through your linked account ↗ Approvals, security and privacy ↗

  1. When a Bot asks for a password, choose Open the screen instead of filling the Secure Form. Since the October 11 release notes, full-screen computer view opens in Watching; press Take control before you type. If the computer is asleep, click the Computer is asleep preview to wake it in place (0.71.2 and later; older versions have a Wake button on the Computer tab).
  2. Type the password on the Bot's computer yourself and press Sign in yourself, then hand control back. Once the page moves past the login form, the password is no longer in the page for the Bot to read.
  3. Treat recovery codes, API keys and other secrets the same way: type them on the screen, never in chat.
  4. If you already entered a password through the Secure Form, change it, as the person who reported the issue did.
  5. Watch the forum thread for Cursor's confirmation of a fix before going back to the form, or to the new Vault, for passwords.

Long threads, and how to start fresh

A Bot's conversation grows without a visible context meter and without a clear or compact option. Cursor staff said in September that every turn re-reads that conversation and the product only summarizes automatically near the model's limit, so a long-running chat costs more on every reply. A forum thread from September describes memory writes failing across a fleet while a state snapshot was cut short.

Start fresh instead of letting one thread grow. Cursor staff recommend a new chat per task, with standing instructions kept in the Bot's profile so they carry over. Since 0.71 the + in the sidebar opens Create new Bot rather than a new chat, which staff said on October 20 is intentional; to open a new chat with the same Bot, press Ctrl+Shift+N, or Ctrl+K and run New group chat, then select that one Bot and press Enter. A Bot made with Create new Bot does not get the old Bot's own memory or routines; it sees only shared memory. To reset a Bot entirely, Duplicate it: the official docs say the copy keeps the profile, settings, enabled skills, routines, and avatar, but not conversation history, learned memory, or attachments, so paste a short handoff summary as its first message. Hide the original rather than deleting it until you are sure: the 0.75.2 release notes say deleting a Bot permanently erases its conversations, memory, routines and attachments and removes its Slack app.

Memory carries further than it used to. The 0.75.2 notes say what a personal Bot saves to memory in one chat is now remembered in all your chats with it. On October 19 and 20 Cursor staff (deanrie) answered a user who saw earlier turns turning up in a new group chat: a Bot's own account of its context is not a reliable signal, because its durable memory is shared across its chats, and staff could neither confirm nor rule out that chat history has started merging across chats, which the team is checking. There is no screen to view or edit a Bot's memory yet; staff suggest asking the Bot to print its memory profile and memory log and delete specific entries, and remember that every Bot can see shared memory.

A forum thread opened August 13 and past 1,500 views, titled a request to prune or compact a Bot's context without creating a new Bot, describes exactly this pain in detail: a fleet operator argued each Bot is one unbounded thread, so obsolete tool dumps and agent-to-agent pings stay in context forever, and the only documented workaround is spawning another Bot, which splits memory and inflates the roster. Cursor staff (deanrie) replied on August 20 and again on September 23 and 30 that durable state already lives apart from the transcript and survives a reset, that a new chat on the same Bot starts with a clean working set (a point staff said on October 20 they are re-confirming), and that an explicit new-session-with-archive control, a manual Compact, and a visible working-set meter are still missing; on October 20 staff said they remain on the team's radar with no timeline. Until those ship, a community workaround from the same thread is to give each long-lived Bot a durable notes file that a routine rewrites at the end of every session, so a reset or Duplicate can point the fresh chat at that file instead of losing continuity; a notes file that stays small while the transcript keeps growing is also a rough signal that tokens are going to large tool output rather than real state.

There is still no one-click export either. A September thread asked for the best way to back up each Bot's individual and shared memory, separate from chat history. Cursor staff (mohitjain) replied that a Bot's durable state lives as plain text files on its own computer that it can zip and hand back: ask a Bot to copy its complete memory, routines and connectors into a backup folder, zip it, and send the zip as a chat attachment, then ask a Chief-of-Staff-style Bot to do the same for shared memory and skills. A reply in the same thread (izgorodin) cautioned against folding that raw backup straight into SKILL.md files, since memory is timestamped, scoped state that can go stale, while a skill should stay a reviewed, stable procedure; staff agreed, and recommended exporting the raw memory as its own zip first and promoting only stable material into skills afterward. The traffic now runs the other way too: 0.77.0 (October 26) adds Import Memory to Grok Bot in Settings, which brings your preferences and context from another AI assistant into your primary Bot, but the changelog describes no export, so the zip procedure above is still the backup route.

Documentation: Create and manage Bots (Duplicate) ↗ Grok Bot changelog: 0.77.0 (browser keeps site logins, Import Memory, Route traffic fixes, October 26) ↗ Forum: context size and token accumulation (staff reply) ↗ Forum: about $1,500 in one week running a Bot fleet (staff reply) ↗ Forum: memory writes fail fleet-wide ↗ Forum: prune/compact an agent's context without creating a new Bot (1,590 views, staff replies through October 20) ↗ Grok Bot changelog 0.75.2 (October 22): shared memory across a Bot's chats, deleting a Bot ↗ Forum: best way to export memory (staff backup procedure, September 7) ↗

  • Nothing signed into the shared computer would be catastrophic if any Bot touched it.
  • Passwords are typed on the Bot's screen yourself (Open the screen), not through the Secure Form, until Cursor confirms the snapshot fix.
  • Plugins are used where they exist; browser logins are the fallback.
  • Local computer execution stays disabled unless a task needs it.
  • New tasks start in a fresh chat, standing rules live in the Bot's profile, and finished Bots are hidden rather than deleted.
  • Long-lived Bots keep a durable notes file a routine rewrites each session, since explicit compact and new-session controls are not shipped yet.
  • Important Bots have had their memory, routines and connectors zipped and backed up at least once, since there is still no one-click export.

Quick answers

Is it safe to enter a password in the Grok Bot Secure Form?

Not for passwords at the moment. On October 5 Cursor staff confirmed a report that a password filled by the in-chat Secure Form appeared in plain text in the page snapshot the Bot took before signing in, which puts it in the session's tool output and transcript. Staff said a fix is in progress and, until it ships, advise choosing Open the screen, typing the password yourself and pressing Sign in yourself. As of October 25 Cursor had not posted a fix in the thread, and the release notes from 0.69.0 through 0.75.5 (October 11 to 23) do not mention one, although 0.71.2 moved logins onto a single Secure Form and 0.75.5 added a Vault that saves and fills logins. If you already entered a password through the form, change it.

Do my Bots have separate computers?

No. The official overview describes one persistent cloud computer per account, with its browser, file system, and terminal shared by every Bot you create, and the FAQ on x.ai/bot, read October 25, says isolation is per user, not per Bot. Separate Bots are separate conversations and roles, not separate machines or separate logins.

Can I use one Bot for sensitive accounts and keep the others away from them?

Not by using Bot boundaries. Any Bot on the account can reach a browser session another Bot signed into. If a login must stay isolated, keep it off the shared computer entirely or use a second account.

Can I clear a Bot's context or start a fresh session?

You cannot clear or compact a conversation; Cursor staff said in September that a Bot re-reads its conversation every turn and only auto-summarizes near the model's limit, and on October 19 that there is still no supported way to shrink a Bot's working set other than Duplicate or Delete. You can start fresh two ways. Since 0.71, staff said on October 20, the + in the sidebar intentionally opens Create new Bot; to start a new chat with the same Bot, press Ctrl+Shift+N, or Ctrl+K and run New group chat, select that one Bot and press Enter. Staff had said on September 23 that such a chat starts with a clean working set, but on October 20, after a user reported old turns carrying over, said they no longer want to claim that until the team confirms it. Or use Duplicate: the official docs say the copy keeps the profile, settings, enabled skills, routines, and avatar but not conversation history, learned memory, or chat attachments. A forum thread open since August 13 tracks the request for an explicit same-Bot new session, a manual Compact and a working-set meter; staff said again on October 20 that these are on the team's radar with no timeline.

Bots for this job

Directory listings that match this guide, read from each creator's public share page. They are not tested picks: check what a Bot can reach before you add it.

Browse: Bots for fleet

  • Reboot by Code Solutions: Safe restart coordinator that checkpoints every teammate Bot before shared-computer recovery
  • Fleet Keeper by TheCoderBTW: Keeps a Grok Bot fleet tidy: inventories bots and channels read-only, flags duplicates, overlaps, stale and unsectioned bots
  • Shepherd by Can Celik: A meta-bot that herds your whole fleet of Grok bots, paired with the herdr tool
  • Alfred by Robin: Designs and keeps restructuring your whole roster of bots

Sources & next steps

Capabilities are grounded in the documentation below. The workflow design and acceptance checks are editorial suggestions.

Build your own workflow brief →