Deploy Grok Bot: Installers, MDM, Versions and Updates

A Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. rollout has four pieces, and only some of them are yours to install. The table lists where each one runs and who updates it.

The apps are clients for chat, review and approvals. The Bots themselves do their work on the member's hosted computer, which runs Linux in Cursor's cloud and isn't enrolled in MDM. So your device management tool reaches the apps on member devices and stops there. Enterprise teams that need their own tooling on the hosted computer use Team Setup Scripts, which the private networks guide walks through.

Turning Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. on and scoping who gets it happens in the dashboard, and that side is covered in the Grok Bot admin overview. This page stays on the installer and the update path.

There are three places to get the installer, and which one you use mostly depends on whether a person or a script is doing the download.

• Cursor dashboard: the Download Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. setup row on the Grok Bot page installs the app or copies a link you can share with members.
• Download page: cursor.com/download/bot lists the current installer for every platform and format.
• Release feed: for scripted packaging, read the current release from the feed and download the file it names.

The formats are fixed per platform. macOS gets a .dmg for Apple silicon and Intel, Windows gets a Setup .exe for x64 and Arm64, and Linux gets .deb, .rpm and AppImage for x64 and Arm64.

Each platform has its own JSON feed. Substitute one of the platform values from the table below into this URL pattern:

https://api2.cursor.sh/updates/api/download/stable/{platform}/sand

The docs give this request for the Apple silicon feed:

curl -s https://api2.cursor.sh/updates/api/download/stable/darwin-arm64/sand

The response can carry more fields than you need. For installing the desktop app, four matter: version is the current release, commitSha is the build it comes from (Linux download URLs include it), downloadUrl is the installer (the .dmg on macOS, the Setup .exe on Windows, the AppImage on Linux), and debUrl and rpmUrl are the Linux packages.

macOS and Windows installers keep a versioned URL for each release, which is what you want when you're packaging a build you already tested. Replace {version} with the release you want:

https://downloads.cursor.com/grokbot/stable/darwin-arm64/{version}/Grok_Bot_{version}.dmg
https://downloads.cursor.com/grokbot/stable/darwin-x64/{version}/Grok_Bot_{version}_x64.dmg
https://downloads.cursor.com/grokbot/stable/win32-x64/{version}/Grok_Bot_{version}_Setup.exe
https://downloads.cursor.com/grokbot/stable/win32-arm64/{version}/Grok_Bot_{version}_Setup.exe

Linux works differently. Packages sit under the release's commitSha rather than its version, in one of these two folders, and the docs say to copy the exact file URLs from downloadUrl, debUrl and rpmUrl in the Linux feed instead of building them by hand:

https://downloads.cursor.com/grokbot/stable/{commitSha}/linux/x64/
.../linux/arm64/

That difference has a practical consequence for record keeping. A Linux version number alone doesn't get you back to the file, so save the full URL along with the version.

Use whatever you already deploy software with. The docs name example tools per platform, and Windows has the one detail that tends to catch people out.

• macOS: deploy the .dmg with your Mac management tool, such as Jamf Pro, Kandji or Microsoft Intune.
• Windows: deploy the Setup .exe with Intune, Configuration Manager or another software distribution tool, installing silently.
• Linux: install the .deb or .rpm with configuration management such as Ansible, Puppet or Chef. The docs prefer these packages for managed fleets.
• iPhone: members install Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. from the App Store on iOS 18 or later.
• Android: members install from Google Play on Android 9 or later. To push it to managed devices, approve it in managed Google Play from Intune or another Android management tool.

The Windows silent install uses the /S switch:

Grok_Bot_{version}_Setup.exe /S

The installer is per user. It lands in the member's profile under %LOCALAPPDATA%\Programs, so deploy it in user context and not as SYSTEM, and test it on a pilot device before the wider push.

Members then sign in with their Cursor account through your normal SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. flow, since Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. has no separate login. Assigning the Cursor app to the right groups in Okta or Entra ID is covered in Grok Bot identity and access.

Pin the version you tested. Download that release's installer, keep it in your own software repository or MDM package store, and deploy from your copy so every new device gets the same build. Cursor doesn't publish how long older installers stay downloadable, which is the reason to keep your own copy.

To check what a device is running, open the account menu in the app, choose Support, then About. The dialog shows Version, and Copy version info copies the version, release track and operating system.

Pinning controls what you install. It doesn't control what happens afterward, and the table shows why the two install types behave so differently.

For the first row, no device policy, installer option or dashboard setting turns updates off. A member can turn off Automatic Updates so updates wait for Restart to Update, but the app still checks and offers them, and there is no admin control for any of it.

Linux packages give you the most control. Installing the .deb adds Cursor's signed apt repository at /etc/apt/sources.list.d/grok-bot.sources, and the .rpm adds one at /etc/yum.repos.d/grok-bot.repo, so devices pick up new versions whenever they run package upgrades. There are two ways to hold them back. The first is your package manager's hold, which you release when you're ready:

apt-mark hold grok-bot

The second is to turn the repository off and ship tested package files yourself. Set this line in grok-bot.sources, or the equivalent in grok-bot.repo. The package rewrites these files on every install and upgrade but keeps your choice.

Enabled: no
enabled=0

Either way, upgrade before the installed version loses support, because a held package still gets the Update required screen.

Cursor maintains the hosted computer's image, so there's no image for you to pin or supply. A computer moves to a newer image in one of three ways.

Running computers pick up Team Setup manifest changes roughly once a day. If you need a change applied sooner, recreate the computers, which the manage computers guide covers step by step. On Enterprise, audit logs record computer updates, resets, recreates and terminations as grok_bot_vm events, and operations across many members as grok_bot_vm_bulk.

Devices download installers and desktop updates from cursor.com and downloads.cursor.com. The app then connects to Cursor's API and the member's hosted computer on a longer list of domains, including the nested *.*.cursorvm.com pattern. Allow all of them and exempt them from TLS inspection before you push the app. The proxy guide has the full list and the verification checks.

Cursor's checklist runs in this order. Most of it happens before a single installer reaches a device.

1. 1Move off Privacy Mode (Legacy)A Cursor data setting that blocks Grok Bot because the product requires cloud data storage. Press Enter for the full definition.. It blocks Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. entirely.
2. 2Clear your network: allow Cursor's domains on your gateway and exempt them from TLS inspection.
3. 3Assign the Cursor app in your identity provider. Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. sign-in uses your Cursor SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition..
4. 4Turn on Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. and choose who gets it. On Enterprise, an admin turns it on from the dashboard and scopes it with Manage Group Access. On Teams, every member already has access.
5. 5Apply the recommended configuration for the admin controls before members start.
6. 6Pilot the installer: install your chosen version on a few devices per platform, sign in, and confirm the app connects to the hosted computer.
7. 7Push the tested installer to every device whose owner has access.
8. 8Plan updates. Pick a cadence for new releases, and for Linux decide whether devices upgrade from Cursor's repository or from packages you ship.

The pilot step is easy to rush. It's the step where you confirm the whole chain, from installer through sign-in to the hosted computer connection, on each platform before the fleet push.