Grok Bot: ship real session fences — bots are not a security boundary

Ideas Feature Requests
, , ,
1

Feature request for product/service

Cursor IDE

Describe the request

Cursor IDE — Grok Bot

Official docs say not to use separate Bots as a security boundary. That’s correct, and it’s the gap.

Several Bots share one cloud computer and one Chrome. chrome://settings/content/all shows hosts and storage, not which account. A cookie-host list is not an inventory. Any Bot can use a session another Bot signed in (example: a site signed in as the human’s Workspace account).

What exists today: approval cards, Auto-review (Require / Always Allow), delete-the-bot. Persona text that says “read-only” is not a lock.

What’s needed:

  1. A signed-in dashboard: Account | Site, grouped by identity. Not cookie hostnames.
  2. Per-Bot browser profiles / credential isolation, or an explicit “this session is usable by Bot X only.”
  3. Named standing writes with scope and revoke (Always Allow that is durable and auditable). Default everything else to a human confirm tap.
  4. An action log: which Bot used which session, and which approvals fired.

Related:

Version: Grok Bot chat — early beta
Does this stop you: No - Cursor works, but with this issue

Operating System (if it applies)

MacOS

5

Follow-up — the UX makes this worse than the docs say.

Grok Bot gives each Bot its own desktop / browser window on one shared cloud computer. Users see different windows and think sessions are isolated. They are not.

What is shared: files, installs, Chrome cookies. If Bot A signs into a site, Bot B opens that same site in its own window and is already in. No new auth. Bot B cannot see Bot A’s screen and cannot drag the window over. It does not need to. It gets the session, not the screen.

This is not multiple monitors on one Mac. On a real Mac you can see every display. Here the screens are separate and the login is not.

That is the gap item 2 is asking for: per-Bot browser profiles / credential isolation, or an explicit “this session is usable by Bot X only.” Until that ships, separate Bots are not a fence, and the UI currently teaches the opposite.