Grok Bot’s “Teammates” Share
One Computer, Its FAQ Says.

Grok Bot’s product page describes it as “AI teammates you can give real work to,” and its FAQ says a user’s Bots share one machine’s “files, browser, logins.” Its guide says, “With Grok Bot, the rules are a prompt.”

By William Douglas Baker

Founding Editor

Shane Mac, whom Business Insider calls the 40-year-old CEO of XMTP Labs, wrote on X on October 6, 2026 that “an AI agent posted my personal bank balances into our company Slack. As me.” In the same thread he wrote that his finance agent “didn’t have Slack.” He told Business Insider, in an as-told-to essay, that it was Thursday, October 1, and that his head of product sent him a Slack direct message that began “Hey, heads-up.”

Grok Bot’s maker is SpaceXAI LLC, the name in its Terms and on its page footer; the pages themselves call it SpaceXSI. The FAQ says: “Every Grok Bot shares one persistent cloud computer. Your Bots share that machine (files, browser, logins), so they can hand work off and keep context. Isolation is per user, not per Grok Bot.” This edition gives Mac’s account only in his words, as his, and sets it beside the maker’s pages, which a reader who hands work to an agent can check for themselves.

What the page and the FAQ say

The product page says Bots “can sign in to your tools, use them just like you do, and come back with finished work.” Under its heading “Message Bots like teammates,” it says to give tasks to Bots “like you would a teammate.” The maker’s launch post, dated August 11, 2026 by its own page, says “Bots share a computer of their own in the cloud, so jobs do not stall when you step away.” The FAQ answer is the passage quoted above, and the list in its parentheses is files, browser and logins. Slack is not on the list. The FAQ is undated, so this edition cannot say when that answer first appeared or whether it was on the page on October 1, the date Mac gives for the Slack post.

What the guide says

The Grok Bot 101 guide, dated September 11, 2026 by its own page, is written in the first person by an author who says “I work on DevRel at SpaceXSI.” We do not name him. He writes that “Using it feels like texting a colleague, except that colleague has a real, persistent desktop.” Of his own setup, he writes that he can click the bot’s window and use that machine like a remote desktop: “The bot has the same access I do.”

“Behind the scenes, settings are three fields,” it says, and its example fills them as Name, Title and Description: “Name: Tech Demos,” “Title: Daily X tech scout.” Calling the title a text field is our label, not the guide’s words. On how a bot is kept in check, the guide says “Bots are kept in check by permissions, a reviewer, and allow/block lists,” that the user writes the rules in natural language, and that “A separate review agent checks proposed actions and can allow, block, or escalate to you.” It adds: “You are trusting the model to follow what you wrote.”

“Most of us are used to defining agent rules in code or JSON,” the author writes. “With Grok Bot, the rules are a prompt.” The same passage says “The work still happens in an isolated environment.” The guide adds: “if you log into a site with one bot, every other bot can reach that site too.” The sentence says “site.” The word Slack is not in it.

Mac’s account

Mac wrote that he set the agent up “for my personal finances,” with “One job: a monthly audit, sent to me privately in Grokbot,” and named it “personal CFO.” At 8:40am, he wrote, it posted that audit “in our team channel, under my name.”

On our reading, three accounts of the mechanism are on the record, they differ, and none settles the cause. In his thread, Mac wrote that “this specific Grokbot agent didn’t have Slack. But another one did. Turns out, they’re all connected.” Mac told Business Insider that “I created a bunch of different agents, and for one of them, I connected my Slack account. But underneath the hood, they’re actually all using the same connections, even if they feel like different agents,” and that “The CFO agent got the channel wrong because the channels had the same name.” In the agent chat shown in Mac’s screenshot, headed “Hamilton,” a reply says “this morning’s monthly financial audit (CFO agent) was written to post the brief to #exec-team as well as your private chat.” That is a chat reply, not a finding.

Mac wrote: “A common response is ‘you set it up wrong.’ I did. I gave an agent a job title as a name and connected Slack to a different agent.” In the sources read, as of October 18, 2026, no primary beyond his own descriptions shows how his bots were configured on October 1; he told Business Insider, “I told it to send messages only to me through Grok Bot.” That includes their written rules, any review-agent, allow/block, draft or approval settings, which bot held the Slack connection and whether others could use it, and the app version. Futurism wrote that “we were unable to independently verify his claims,” and Gadget Review wrote that “The incident has not been independently verified.” Replying on X at 23:09 UTC on October 6, 2026 to a user’s claim that his post was fake, Mac wrote “not fake at all, genuinely happened.” In the sources read, as of October 18, 2026, no first-hand statement from SpaceXAI or SpaceXSI about Mac’s case appears.

The Terms and the changelog

x.ai’s consumer Terms, in the version dated October 12, 2026, say in section 4: “We are not responsible for User Content or Agentic Actions.” The next sentence begins “You are responsible for User Content and Agentic Actions,” and continues. The Terms define Agentic Actions as autonomous actions Grok may take “on your behalf,” and an archived version dated September 11, 2026 carries the same two sentences. In the Terms, the party responsible for Agentic Actions is “You.” In the FAQ, isolation is “per user, not per Grok Bot.”

The maker’s changelog entry dated October 11, 2026, version 0.70.2, which also covers 0.69.0, 0.69.1, 0.70.0 and 0.70.1, includes two lines: “After a bank or brokerage connector returns data, the Bot asks before sharing it anywhere else,” and “Before an action it can’t undo, such as sending, posting, buying, or deleting, a Bot checks your own messages for approval.” Mac told Business Insider that Grok “implemented and shipped a solution last night”; the essay is dated October 9, 2026, two days before the entry. The entry names no incident and is not shown to be the change he describes; we draw no connection to Mac’s post.

What this asks of a bot’s name

On our reading, the maker’s pages put three things side by side that a reader can take for one: what a bot is called, what governs it, and where its walls run. These are statements about the product.

Where the argument stops

This edition states no cause for the post. No primary read through October 18, 2026 shows how Mac’s bots were configured. Which Terms govern Mac’s account was not established. The guide’s date is a page date, not proof its text stayed unchanged. Among reports read in full, as of October 18, 2026, none says it independently confirmed the event. The Wall Street Journal’s report could not be read past its preview.

Disclosure: Declassified is researched and drafted with AI tools, and an OpenAI model gave this edition’s evidence ledger an outside read. Agentics builds AI agents for its clients. Futurism wrote that Mac is building a tool to “connect various AI agents” and let users “set rules.” His X profile, captured October 13, 2026, reads “building @agentpicnic.” We map the record, not any person or company, to Digital Derangement Syndrome™ (DDS™); on our reading, the record is consistent with Trust Transfer Failure (expertise never translated into machine-readable trust) run in reverse: a bot’s name and title, in the guide’s example, are words typed into fields. That mapping is editorial, not any source’s finding.