A Grok Bot can see everything on its cloud computer, every app you connect, and whatever you send it in chat. It can't see the computer in front of you unless you allow that, and it isn't supposed to see your passwords, because you type those in yourself.
What a Bot can see
Its cloud computer. Every Bot works on a cloud computer with a browser, files and a command line. Use the computer and apps says all of your Bots share that one computer. They share its browser cookies and signed-in sessions, its files, and its command-line credentials. If you sign in to a website for one Bot, your other Bots can use that same session.
The apps you connect. Connectors give a Bot a direct way into services like email or a CRM. The same page says installed connectors are account-wide, not limited to one Bot. The security page adds that the login tokens for connectors stay on Cursor's backend. Bots use the tools without receiving those tokens, and the tokens are never stored on the computer.
Public X posts. Bots can search and read public posts on X without you connecting an account. That access is read-only and doesn't sign in as you. Your DMs, bookmarks and home timeline stay out of reach until you add the X plugin and sign in, according to Use the computer and apps.
What it remembers. The FAQ says a Bot can keep stable preferences, role context and summaries of past work. Each Bot has its own conversation, but shared files, group chats and handoffs can pass context between Bots.
What a Bot can't see by default
Your own laptop or desktop. The cloud computer is separate from the Mac or Windows computer in front of you. Approvals, security, and privacy says Execution on Local Computer starts on Ask every time. The other choices are Always allow and Never allow. After your account has registered computers, the choice moves to Settings → Computer → Computers, and each computer has its own setting. The docs suggest Never allow unless a Bot has a specific reason to work on your local files. When this access is on, the security page says a Bot can run commands, read files and move files between the two computers. By default, each command waits for your approval, and the approval card shows the exact command.
Your passwords. For passwords, passkeys, two-factor codes, CAPTCHAs and payment checks, the Bot hands you the computer. You choose Take over, finish that step, then choose I'm done. Some connections show a secure secret box instead. The docs say whatever you type there is masked, kept out of the conversation, and not shown to the model. Don't paste a password or one-time code into ordinary chat.
You can watch what it does
You can open the computer from any conversation to see the shared desktop. Use the computer and apps says the preview shows clicks, typing, page changes and current status. Actions that need your approval show the exact action and its details first. You can then choose Allow once, Always allow or Deny.
Where your data goes
- Account and privacy settings: Grok Bot uses your Cursor account and its data settings. Whether your data is used for training follows those Cursor settings. Grok Bot needs cloud data storage, so it doesn't work with Legacy Privacy Mode (FAQ).
- Encryption: x.ai/bot says your cloud computer is encrypted in transit and at rest, with a training opt-out.
- Location: the security page says Grok Bot computers run in the United States today. That is not the same as Cursor's US-only data residency program, which the same page says does not apply to Grok Bot by default.
- AI model providers: the same page says those providers don't keep your prompts or outputs under Cursor's agreements with them. Providers may still run abuse and safety checks, and flagged data may be stored for investigation.
- At work: some companies can turn on extra logging. On Enterprise plans, an admin can switch on Action Recording, which is off by default and keeps a record of Bot actions for 90 days. Exporting conversation text to the company's own systems is also Enterprise-only and off until an admin enables it (security).
The docs we checked don't give a retention period for a regular personal account's conversations. They say backend retention follows the applicable Cursor terms.
Sharing a Bot doesn't share your data
A share link copies a Bot's setup: its identity, description, skills and routines. Create and manage Bots says the person who adds it doesn't get your computer, logins or conversation history. Still, remove secrets, customer data and internal links from the description and skills before you share.
How to take access back
Deleting a Bot does not remove files or browser sessions from the shared computer. Approvals, security, and privacy gives this cleanup order:
1. Pause or delete any routines that use the project. 2. Sign out of websites on the shared computer. 3. Uninstall connectors and revoke their access in the service itself. 4. Remove sensitive files from /workspace. 5. Hide or delete Bots you no longer need. 6. Use the account settings if you want to delete the Cursor account.
The docs also say not to use separate Bots as a privacy wall. If one Bot shouldn't have a file or login, don't put it on the computer at all.