State of Grok Bot — August 2026

Grok Bot launched in beta on August 11, 2026 — a joint xAI/Cursor product that gives each task its own persistent cloud computer, its own logins, and the ability to keep working after you close the device. Fifteen days later the entry price had fallen 93%, from a $300/mo SuperGrok Heavy floor to $20/mo on Cursor Pro. In between: a multi-day outage starting Aug 20 where Bots failed mid-turn; an access expansion on Aug 21 that added a free trial; a bundling on Aug 26 that put the Bot inside every SuperGrok and Cursor Pro plan; Stripe Link purchasing on Aug 28; shareable Bot templates the same day; and, within 48 hours of templates shipping, a paid resale marketplace taking a 15% cut of a feature xAI gave away for free.

The ecosystem grew faster than the product. Our registry folds 1,214 unique bots out of 1,633 rows scraped from five independent directories, plus 257 plugins and 19 open-source clones. What it does not yet have is a safety floor: of the 394 bot prompts with text we could analyze, 24 ask for a consequential capability — sending, spending, logging in, or driving a signed-in browser — with no human approval step written into the prompt.

At launch Grok Bot was not sold standalone. Access rode on three existing plans: SuperGrok Heavy at $300/mo, Cursor Ultra at $200/mo, and Cursor Premium Teams at $120/seat/mo. There was no free tier.

On Aug 21 xAI extended access to SuperGrok Plus, Cursor Pro+, and all Cursor Teams plans, and opened a limited free trial to everyone else. Narrative sources describe this as an effective drop to a $100/mo floor (SuperGrok Plus); the official post itself states no dollar figure, so treat the middle step of the chart below as derived rather than quoted.

On Aug 26 the Bot was bundled into all SuperGrok and Cursor Pro plans with weekly usage reset for everyone — $30/mo on SuperGrok, $20/mo on Cursor Pro, with Bot usage metered separately from existing plan usage. Fifteen days from a $300 floor to a $20 one.

What is still not published anywhere: the weekly Bot usage allowance in tokens or runs, the Cursor Pro+ monthly price, and any enterprise price. Overflow spills into shared on-demand billing, so the sticker price is a floor, not a ceiling.

We merge five independent bot directories into one registry, folding duplicates by normalized identity. The raw pull is 1,633 listings; 419 of them (25.7%) are the same bot listed twice or more, leaving 1,214 unique bots. That duplication rate is the single most useful number here: a quarter of the visible ecosystem is the same prompts re-listed across competing directories.

Plugins are the opposite story — 257 unique out of 259 raw rows, only 2 duplicates, because there are effectively two catalogues rather than five, and one of them (219 listings, captured on day two from the in-app marketplace) dominates.

The clone lane is where the numbers get lopsided. We track 19 open-source clones, ports, and shims. Seventeen have live GitHub star counts totalling 5,605 stars — and 5,344 of those (95.3%) belong to just two repos: a reconstruction of the Grok Bot 0.18 client (3,452) and OpenMausBot (1,892). The remaining fifteen average 17 stars each. Two repos, rakazo and CopilotKit's OpenBot, returned HTTP 403 on the star fetch with no cached snapshot, so they are tracked but not counted in the total — both are prominent launches, so the real figure is higher than 5,605.

An approval gate is a sentence in a bot's own prompt that keeps a human in the loop before the bot does something consequential — "ask me before sending", "drafts only, I send them", "never buy anything without my explicit ok", "wait for my go-ahead". It is not a platform control. It is text the bot's author chose to write, and it is the only thing standing between an always-on agent and your inbox, your card, or your logged-in browser session.

We scanned the prompt text of every bot in the registry that publishes one — 394 of 1,214; the other 820 listings carry no prompt text to analyze, which is itself a finding about directory quality. The scanner is deliberately conservative: it matches specific anchored phrases rather than bare keywords, and it returns the matched span as evidence so any call can be audited. It never runs a prompt; it reads it as a string.

34 bots ask for at least one consequential capability. 24 of them contain no approval gate at all. Two of those 24 are in the 25 most-copied bots in the registry: be-happier (flagged for sending on the user's behalf) and point-peddler (flagged for both spending and logins). Only 108 of the 394 analyzed prompts (27.4%) include a human-approval sentence of any kind.

Context for why the prompt is doing this much work: a review dated Aug 27 found that the one shared computer is not a security boundary between a user's own Bots, that auto-review of agent actions is best-effort rather than guaranteed, and that xAI's public docs do not mention prompt injection as a risk. The Stripe Link purchasing feature shipped Aug 28 does keep an explicit per-spend human confirmation and a single-use card — a platform gate, and the right model. Most bot prompts are not that careful.

Methodology caveat: only 7 registry bots carry both a published prompt and a real install metric, so per-popularity claims are limited to those 7; corpus-wide counts cover all 391 analyzable prompts. The high logins count (319/391) reflects that most shared bots begin with "connect your <service>" setup steps — it marks credential handling, not malice. Detectors are conservative with negation guards; full spans in data/reports/risk-audit.json.

The last week of August was a land grab. In nine days, five third-party sites shipped machine-readable contracts or launched outright:

• Aug 26 — grokbot.dev added /news/, api/v1/news.json, and RSS, with a changelog instructing syncing bots to surface news ahead of use cases and plugins.
• Aug 27 — grokhub.io shipped a v1 bot contract: status.json, a lean feed.json, per-type detail endpoints, and a Streamable HTTP MCP server at /mcp with search, whats_new, and get_entry tools.
• Aug 28 — xAI shipped official Bot templates: a public x.ai/bot link that copies a Bot's identity, skills, and routines (not its computer or logins). grokbot.dev indexed them the same day at /marketplace/, with the share_url and a sharer credit on every entry. grokhub.io added narrative and screenshot fields to its detail payloads.
• Aug 29 — really.bot shipped its v1 machine contract, including an optional grok_share_url field when a run has an official template link. Runtime Wire reported a Marketplace tab for installing complete third-party Bots in preview, with a Bots tab "coming soon".
• Aug 30 — three template directories launched in a single day: Grokyard, a paid yard listing share links from $8 with a 15% platform cut; ShareGrokBots, which scores live templates against a standard task instead of star ratings; and gbt.grok.me, a community desk where people paste links and describe what the Bot actually did.

The structural risk sits underneath all of it. As of Aug 29 xAI had share links but no official gallery. The day it publishes one, every directory whose only product is a list of copyable prompts is competing with the vendor's own default surface, inside the app, for free. Runtime Wire's preview report — unverified, and worth treating as a signal rather than a roadmap — says a Bots tab is exactly what is coming. The directories that survive that are the ones holding something a first-party gallery will not carry: dated history, dedupe across sources, independent risk analysis, and provenance.

These are watch-items, not forecasts. Each one is a specific open question left behind by a dated August fact — we are naming what is unresolved, not predicting how it resolves.

Whether an official gallery lands. Templates shipped Aug 28; a Marketplace tab for complete third-party Bots was reported in preview on Aug 29 with a Bots tab "coming soon" (Runtime Wire, unverified). This is the single event that most changes the shape of the third-party directory layer.

Android. The Google Play listing began showing an Install button around Aug 29 while Cursor's own help documentation still described the product as iOS-only. Two first-party surfaces disagreeing is not general availability. Watch for the docs to catch up — or for the listing to go back to pre-registration.

The meetup run. Shenzhen on Aug 30 was the first in-person meetup in China, and it was announced as part of a wider push with San Francisco, Las Vegas, Macau, and Tel Aviv lined up over the following two weeks. Those are the dated events on the board as September opens.

Whether the $20 floor holds, and what the allowance actually is. The Aug 26 bundling reset weekly usage limits for everyone but published no allowance in tokens or runs, and overflow bills on demand. The Cursor Pro+ price and the free trial's exact terms (reported as 7 days, card required) are still not confirmed in a dated official post.

Reliability. The multi-day outage that began Aug 20 — Bots failing mid-turn, with staff pointing users to Reset Grok Bot's Computer as the workaround — has no dated all-clear in our timeline. A second incident on a plan base 15x larger than launch week's is a different event than the first one was.

The safety floor. 24 flagged bots with no approval gate is today's number against 394 analyzable prompts. As directories grow and templates become a paid product, the interesting question is whether that ratio improves, holds, or gets worse as the listing count climbs.