Grok Bot Security: Controls for Reviewers and Admins

The desktop and mobile apps are thin clients. Each request goes to Cursor's servers. From there, the work runs on the member's hosted computer, prompts go to model providers, and tool calls reach third-party services through connected apps. Cursor's security docs put a control on each of those paths, and the sections below follow them.

Between users, the boundary is hardware. Each user gets a dedicated Firecracker microVM with its own kernel, memory and virtual devices, and one user can't reach another user's computer.

Within one user, Bots separate personalities and workspaces, not compute. Every Bot that person runs shares the same computer, so Cursor's docs say to treat a login or file on it as available to all of them. To give a workload a separate computer and credential set, create a separate Cursor user for it. A teammate's shared Bot, which Cursor used to call a Team Bot, is different: in your own chat with it, the Bot usually works on your computer, not the owner's.

Only Cursor-hosted cloud computers run Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition.. On-premises deployment, deployment inside your own perimeter and bring-your-own-image deployment are not supported today. The computers run in the United States, and Grok Bot is also covered by Cursor's US-only data residency program. For enrolled customers, that program keeps inference, data processing and storage for Grok Bot in the United States. Your account team handles enrollment, and Cursor's residency docs list the supported models, exclusions and pricing.

Network Controls is the egress controlNetwork policy for where Cloud Agents may send traffic: an access mode (Allow all / Default + allowlist / Allowlist only) set per user or per saved environment, with Cursor's own services and SCM providers always reachable; Enterprise admins can lock it org-wide. A denylist with DNS filtering and an HTTP proxy has been described as planned, not shipped. Press Enter for the full definition., and it is Enterprise only. Admins set it under Network on the Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. page of the Cursor dashboard, in Grok Bot Network Access. Self-serve Teams don't see the panel. A team without a policy defaults to allow-all, so state the team's mode first in a review.

Destinations can be web domains or IP ranges with ports, with no cap on entries. A directory group can carry its own policy, which replaces the team's for its members, and a lock makes the team policy apply to everyone. Running computers pick up a change within about a minute and sleeping ones when they next wake, so nobody has to recreate a computer. The policy is separate from Cloud Agent network settings.

Turn on Apply to MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. servers before you rely on an allowlist. Bots reach remote MCP servers from Cursor's servers, so an allowlist mode doesn't cover them by itself. The switch shows only in the two allowlist modes and is off by default for every team.

Once the switch is on, every connected app is checked by the hosts it sends requests to. That includes built-in connectors such as GitHub, X, Origin, Google Workspace and Microsoft 365. Add their hosts to Allowed destinations before you turn it on, such as api.github.com for GitHub. Otherwise the connector is refused the next time a Bot uses it.

Connector policy and network policy are separate layers. Blocking an app doesn't block that service's website, so closing both paths takes both controls.

By default, outbound traffic leaves from shared static egress IPs. The ranges are shared across Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. customers, and dedicated per-customer IPs aren't available. Treat the ranges as identifying Grok Bot traffic rather than your team alone. Your account team has the current ranges.

A member can instead route the computer's web traffic through their desktop, using the desktop's network and IP address. Sites that resolve to a private or VPN address stay blocked on that route unless they've been allowed for your organization. On Enterprise, admins can turn the option off for the whole team with Allow Local Egress Routing, and active routes stop within five minutes.

Two related jobs have their own guides. Clearing a TLS-inspecting gateway on member devices is covered in Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. behind a proxy. Routing computer traffic into internal services is covered in Grok Bot private networks.

Approvals keep consequential actions under the member's control. Cursor's docs call the request itself the strongest boundary, so members should state what a Bot may change and where it must stop.

When an action needs approval, the conversation shows the proposed operation and its inputs. The member picks Allow once, Always allow (which can save a matching rule) or Deny. After Deny, the Bot doesn't try the action again until the member sends another message. The controls are the same on iPhone.

Auto Review, the layer behind those prompts, is an independent review model that checks risky actions before they run. It covers shell commands, app calls, computer use, automation writes, and delegation such as Cloud Agent and subagent launches. It can let an action proceed, require approval or deny it. Admins and members shape it at these levels:

Personal rules added on top of team rules can only make behavior stricter, and Ask first wins when rules conflict. Auto Review also doesn't review every side effect. Memory writes and most settings changes fall outside it. Cursor's docs present it as a complement to controls that don't depend on a model's judgment: per-action approvals, the network policy and per-user isolation. Rule design and the member's view are on Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. approvals.

Yes, through the desktop app. A Bot can run commands and read files on the member's own machine, and move files between that machine and the cloud computer. Local execution has its own control, separate from Auto Review. By default each command needs approval, and the card shows the exact command.

Members choose Ask every time, Always allow or Never allow under Settings > Computer > Your computer. Admins can cap that for the team with Execution on Local Computer, and a member's stricter setting still applies. Unless a Bot has a specific reason to work on local files, Cursor's security docs recommend Never allow.

Inference hooks control what reaches the model. Cursor sends each Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. model request, signed, to an AI security server your organization runs or uses through a security vendor. That server allows or denies the request before the model runs, so your own policy can check prompts and the content Grok Bot gathers, such as web pages and app results. Hooks are in beta and available to all Enterprise teams.

New configurations start in Shadow mode, which records denials in the audit log without blocking anything. You see what a policy would have stopped before it stops anyone. Hooks check model inputs, not actions as they run, so keep the network policy and Auto Review in place beside them. Setup, modes and the request format are on Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. inference hooks.

In a prompt injection, content a Bot reads from a web page, an app result or command output tries to steer it. Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. layers its defenses against that. Outside content is marked as untrusted data when it's presented to the model. When enforcement is on, Auto Review checks actions against the member's request. Below Auto Review sit controls that don't depend on any model's judgment, including the network policy, per-action approvals and per-user isolation.

Cursor's docs say these controls reduce the risk from malicious content but don't eliminate it, and they call that another reason to keep consequential actions behind approval.

Members sign in with their Cursor account, so your existing Cursor SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. configuration applies. SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. 2.0 works with Okta, Microsoft Entra, Google Workspace and OneLogin. SSO can be required for everyone, which blocks password login. SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. 2.0 provisioning is Enterprise only.

Inside the hosted computer, members sign in to company apps through your identity provider in the browser, much like enrolling a new laptop. Your session policies govern those sessions. Okta and Entra steps, including sign-in rules for the computer browser, are on Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. identity.

A Bot has no identity of its own. It works with the signed-in member's access, can't hold more access than that person, and every action stays attributable to a named member. Team-managed connectors are the one exception: they may use team or service-account credentials. Credentials are handled so the model never holds them:

• Connector OAuth tokens stay on Cursor's backend. Bots invoke tools without receiving them, and tokens are never stored on the computer.
• Logins from Vault, a connected password manager or a Secure Form are filled into the page by reference. The model never receives the password, card number or security code.
• Single sign-on, passkeys and other steps a form can't handle are handed to the member.
• An API key goes in a secure secret card, which masks the value and keeps it out of the transcript and away from the model.
• A card saved in Vault fills at checkout without a separate approval each time. Vault isn't available on shared Bots.

Offboarding has two parts. To end a member's current work, an organization admin or Enterprise team admin terminates the member's computer with the Manage Member Computers and Data tool, which is Enterprise only. Terminate stops running Bots and keeps the durable disk, and the member's next session starts a fresh computer on it.

Terminating doesn't remove access. For that, remove the member from the team or turn off Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. for their group, and revoke their sessions in your identity provider. Bulk Recreate, Terminate and Delete are covered on managing Grok Bot computers.

Members clean up project access themselves. They pause or delete related routines, sign out of websites on the computer, remove connected apps and revoke them in the source service, and clear sensitive files from /workspace. Deleting a Bot doesn't remove computer files or browser sessions.

On Enterprise, yes. Audit logs and Action Recording are separate pipelines with different contents and destinations, and the usage page shows spend:

Action Recording events don't appear on the Audit Log page, so a SIEM fed only from the audit log stream doesn't receive them. To get the sanitized events into your own collector, configure OpenTelemetry Export, which is also Enterprise only. Privacy Mode (Legacy)A Cursor data setting that blocks Grok Bot because the product requires cloud data storage. Press Enter for the full definition. forces recording off.

For endpoint tooling, Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. doesn't ship a built-in customer-facing telemetry or EDR feed. Cursor monitors the computers for operational health and abuse, and that telemetry deliberately excludes customer data. Enterprise admins who want their own agent on every team computer can install it with Team Setup Scripts.

Each member's computer keeps local files, browser sessions and anything saved in the browser on a durable disk across sessions. Idle computers hibernate, and hibernation is not deletion. Image updates and member resets rebuild the computer and keep its files. A reset can lose very recent changes if the computer can't be reached to save first.

When the service ends, the Data Processing Agreement governs deletion: data is deleted or returned within 30 days of your written direction. The production control plane has daily encrypted backups, replicated to a separate recovery facility. Cursor doesn't offer a per-organization retention policy or a customer-managed point-in-time restore of an individual computer.

Model choice is up to Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition., and there is no customer-facing model picker. The serving mix can change over time, with no fixed vendor set guaranteed. Any given request is served by either a first-party xAI model or a third-party model from a provider on Cursor's sub-processor list. Usage views record this activity as Grok Bot usage rather than by model.

Your team's model allowlist doesn't apply to Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition., and teams with an allowlist see an acknowledgement when they enable it. A contract that restricts subprocessors is a conversation for your account team.

While a member is on your team, the team's privacy mode governs them, and with Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. on, customer data isn't used for training. Privacy Mode (Legacy)A Cursor data setting that blocks Grok Bot because the product requires cloud data storage. Press Enter for the full definition. blocks Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. entirely, and admins are prompted to change it before enabling. Zero Data Retention follows Cursor's existing provider agreements, with no separate Grok Bot control. Providers may still run abuse and safety classifiers and store flagged data for investigation.

Check the plan before you assess any single control. Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. is included on Teams, but self-serve Teams don't see most of the settings above. A review that assumes Teams gets network policy or audit logs will be wrong. Cursor's docs mark the split this way:

Rollout order, the recommended baseline and the full dashboard settings list are on the Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. admin overview.

Anysphere, the company behind Cursor, holds ISO/IEC 27001 and ISO/IEC 42001 certifications issued by Schellman, and Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. is in the current ISO scope. ISO/IEC 27001 covers the information security management system for the whole organization. ISO/IEC 42001 covers how Cursor governs the AI it builds and operates. The trust.cursor.com site has the certificates and reports.