# Grok Bot ExternalShell blocked despite Always allow **URL:** \ **Category:** Bug Reports\ **Tags:** auto-run, terminal, grok-bot\ **Created:** [August 12, 2026, 3:16pm UTC](https://forum.cursor.com/t/grok-bot-externalshell-blocked-despite-always-allow/168180 "2026-08-12T15:16:20Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![durden](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/durden/32/111800_2.png) [@durden](https://forum.cursor.com/u/durden)\ **Post date:** [August 12, 2026, 3:16pm UTC](https://forum.cursor.com/t/grok-bot-externalshell-blocked-despite-always-allow/168180/1 "2026-08-12T15:16:20Z")
### Where does the bug appear (feature/product)? Somewhere else… ### Describe the Bug User has Settings → Agent → Execution on Local Computer → Always allow. Persisted setting on the box confirms localToolPermission: “always” with no localToolPermissionCeiling. Repeated ExternalShell calls still fail immediately with the canned UNAPPROVED message. No approval card appears in the UI. Same failure class was also seen from another agent’s subagent (Chief of Staff / LinkedIn resume probe) on the same account today. ### Steps to Reproduce 1. Ensure Execution on Local Computer = Always allow (user reports UI shows this; box settings file matches). 2. From agent Aristotle, invoke ExternalShell with a trivial command, e.g. echo probe && whoami && hostname. 3. Observe immediate failure with the UNAPPROVED text above. 4. Observe no local-computer approval card. ### Expected Behavior I was prompted to permit Grok Bot agents to run local commands and clicked always allow. Confirmed this in settings. I would like that setting to be honored so they can run commands locally on my machine. ### Screenshots / Screen Recordings ![grok bot external shell issue.jpg](https://us1.discourse-cdn.com/cursor1/original/3X/1/c/1c0bb328a283f689d941980dd074c0d4c0a6c317.jpeg) ### Operating System MacOS ### Version Information Grok Bot Version: 0.16.0 Release Track: stable OS: darwin ### For AI issues: which model did you use? Uncertain, Grok Bot ### For AI issues: add Request ID with privacy disabled Convo ID: Aristotle (agent c639e327-8b81-4c79-b51f-89a3e666a6c6) machineId bf711521-95e8-47ba-bda9-f240cc5fb88f ### Additional Information The agent generated a bug report Markdown to provide to you, I am e-mailing that to [hi@cursor.com](mailto:hi@cursor.com) with a link to this topic. ### Does this stop you from using Cursor No - Cursor works, but with this issue ---
**Author:** ![mohitjain](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/mohitjain/32/100229_2.png) [@mohitjain](https://forum.cursor.com/u/mohitjain)\ **Post date:** [August 13, 2026, 8:35am UTC](https://forum.cursor.com/t/grok-bot-externalshell-blocked-despite-always-allow/168180/6 "2026-08-13T08:35:08Z")
Hey! Thanks for the detailed report. Your Always allow setting is genuinely set, so this isn’t something you misconfigured - it’s an issue we’re tracking. To unblock you now: 1. Fully quit Grok Bot with Cmd+Q (closing the window isn’t enough). 2. In Terminal, run `ps aux | grep local-exec-daemon` and `kill` any leftover processes. 3. Relaunch Grok Bot. 4. In Settings → Agent → Execution on Local Computer, switch to Ask every time, then back to Always allow. Updating alone won’t clear this, so run the steps even on the newest build. Let me know if `ExternalShell` still errors afterward. ---
**Author:** ![Artemis1](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@Artemis1](https://forum.cursor.com/u/Artemis1)\ **Post date:** [August 20, 2026, 6:29pm UTC](https://forum.cursor.com/t/grok-bot-externalshell-blocked-despite-always-allow/168180/8 "2026-08-20T18:29:59Z")
Same issue here on Mac + Grok Bot. When an agent tries ExternalShell (open Chrome, Finder, or [youtube.com/feed/history](http://youtube.com/feed/history)), it fails immediately with: “That action was not approved on the user’s computer… set Settings → Agent → Execution on Local Computer to Always allow.” No Allow card appears in the Grok Bot chat. I have looked for it and I cannot find it. I also cannot find that exact setting anymore. In Cursor it now looks like Settings → Agents → Approvals & Execution, not “Execution on Local Computer / Always allow.” Sometimes a later “try again” works. Most of the time it stays blocked and I never see a prompt. I was also offline when one of these requests happened, and still saw no card when I came back. This is the same “no approval card” failure, plus the setting name/path seems to have changed, so I don’t know what to toggle.