Security issue- you cannot remotely sign out of a mobile phone that is signed in to Grokbot via Cursor - the session does not show up on the Cursor settings page.
Mobile phone session does not show up on the list and even after signing out of every session on the list, that mobile phone session stays logged in.
Expected Behavior
The mobile phone session signed in to on step 1 should be listed there and it should be possible to end that sessions. But it isn’t - meaning a mobile phone session wit access that needs to be revoked is… stuck unless you delete the entire cursor account (I can’t see of any other workaround if you don’t have access to the phone in question any more).
In the Active Sessions list, the Grok Bot app on your phone is shown as “Grok Bot” with a phone icon. It does not appear as “Mobile App” or with your device name. If you revoke that entry, your phone will be signed out. Revoke may not take effect right away and can take up to 10 minutes. On our side, we can see that the Grok Bot session on your iPhone stopped being accepted shortly after you revoked the sessions this morning. Until the app contacts the server again, it may still show chats that were already loaded. After that, it should show “Sign-in expired”.
There are two things that can make it look like sessions are still active:
Grok Bot on your computer has its own connection, and about every 30 minutes it adds a new “Desktop App” entry. So those entries can come back after revoke. That is not your phone, but I agree it looks confusing. There is no separate “sign out everywhere” button right now that also covers the computer app. We’re tracking this issue, and I passed your case to the team.
If the desktop app is open while you’re revoking entries one by one, it may refresh before you get to its last entry. To avoid that, first close the desktop app, then revoke the sessions.
Could you please check two things:
Open Grok Bot on your phone and try sending a message. Does it send, or does the app ask you to sign in again?
Refresh cursor.com/dashboard/settings and send a screenshot of the Active Sessions list. You can blur anything private.
Also, one more thing. Do you have the phone with you now, or are you asking in case it was lost? If you no longer have access to the device, please say so, because that matters.
Yes, I did see the Grokbot sessions - and I signed out of all of them. I actually signed out of every single session, which also ended up signing me out of my own session. Then when I signed back in, that web browser session was the only active one.
There are 2 phones - I have access to one and not to the other (hence this whole procedure). After signing out of all sessions (regardless of whether they were labelled Grokbot or web browser or whatever else), I was still getting notifications on the phone I do have access to. That is what drove this post. Going into the app, I can see all my bots, although you are right - I cannot actually send a message.
(Update - And since trying to send a message on my phone, not notifications have stopped as well). It still looks like it is signed in but seems on the surface now…
Ok another update - there is 100% an issue - see screenshot below. These notifications are all being received by my phone that is not signed in (i.e. - opening the chats themselves says “cannot refresh”). The should not be able to receive these notifications.
Hey, thanks for the details and the screenshot. You’re right about notifications.
Revoking a session in Active Sessions does log the phone out, but right now it does not stop Grok Bot push notifications on that device. Because of that, a logged out phone, including one you no longer have, may still show bot notifications with message previews. That should not happen, and it isn’t related to your settings. I’ve passed this to the team as a security issue, and I’ll reply here when there’s an update.
For now, you can turn off notifications for each bot from a phone you still have:
Open Grok Bot and go to the bot you want.
Open the bot profile by tapping the name or avatar at the top.
Turn off Notifications.
Repeat this for each bot.
This setting is stored on our side, so it applies to all devices, including the lost phone. The downside is that these notifications will also stop on your current phone until you turn them back on.
If Find My was enabled on the lost phone, you can also erase the device remotely through iCloud via Find My > Erase This Device. That will remove the app and anything it cached.
One important thing to check. We can see a new Grok Bot mobile login on your account on October 18 at about 19:20 Perth time. Was that you, on a phone you still have? If you’re not sure, open cursor.com/dashboard/settings, revoke any unfamiliar Grok Bot sessions, and check the active sessions with the provider you use to sign in, like GitHub. Let me know what you find there.
