Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Grok Bot Use Your Logged-In Sessions?
Grok Bot works inside the browser sessions its cloud computer already holds, and every Bot on the account shares those sessions and app logins. Ask how a session is scoped to one site, who approves a first sign-in, and what record shows what the model read.
A person leaves a bank tab open while answering email, and a Bot working on the same cloud computer can read that tab the way the person would. The session, not the password, is what the Bot uses: the page opens signed in, with the balance, the account number and the payee list already drawn, and no second factor interrupts a request the browser has already authenticated. xAI's documentation describes a persistent cloud computer with a browser for each Bot, and it says every Bot on an account shares that computer's files, browser sessions and app logins (xAI, 2026). The same page says that "between users, isolation is strict," which answers who can reach the machine and leaves open which sites a session inside it can reach. A password can be rotated after a bad run; a session stays signed in until someone signs out or the site expires it. Is It Safe to Give Grok Bot Access to Your Company Systems? records how the launch audience read the design: of the 117 comments that took a position, 85% were negative. No page reviewed describes a session scoped to the site that created it, so this page works one record type, a bank tab left open, through what the Bot inherits, what the model receives, who approves a first sign-in and what record remains.
Key findings
- For a bank tab to stay out of a Bot's reach, the values the page renders would have to be replaced with consistent tokens before the model reads it, so the Bot works on ACCT_001 and the real account number appears only at the approved destination (What Is Least Exposure?).
- It would also require a named person approving each first sign-in and each transfer the Bot proposes, plus an exported record of what the model received on every screen it opened (What Is a Tethered Agent?).
- The gap is scoping: the documentation describes one shared set of sessions and logins for every Bot on an account, and it does not state that a browser session is limited to the site that created it (xAI, 2026).
- OpenAI's governance paper calls human approval "a standard way to limit egregious failures," which is the control a first sign-in to a new payee needs (Shavit et al., 2023).
- AWS's guidance says audit logs "attribute every action unambiguously to either an agent or a human actor," and a Bot browsing through a person's session is the case the test separates least well, because the login in the log is the person's (AWS, 2026).
- Research on agent infrastructure lists "attributing actions, properties, and other information to specific agents" as a function an agent deployment needs, which a shared browser login cannot supply (Chan et al., 2025).
Does Grok Bot use the sessions already open on its computer?
Take the bank tab as the record. It is open on the cloud computer, signed in through the owner's session, and it shows a checking balance, the account number in the header and a payee list behind the transfer action. A Bot asked to check the balance does not need the password: it opens the bank, and the page arrives signed in because the session is already there.
xAI's documentation describes the machine in one sentence: "Each Bot works on a persistent cloud computer with a browser, filesystem, and terminal," and it adds that "between users, isolation is strict" (xAI, 2026). The boundary the page draws is between accounts, not between Bots, so a session one Bot created is available to the next Bot on the same account and to any Bot added later.
That is what makes the session the credential. A password can be rotated after a bad run; a session lasts until someone signs out or the site expires it, and the run that uses it can finish before anyone looks. A browser agent does not need to know a session exists to use it, and a laptop agent inherits the same exposure when it drives a signed-in profile (Does a Coding Agent Running on My Laptop Have My Logged-In Sessions?). The documentation reviewed does not describe a per-Bot sign-out at the end of a run or a setting that limits a session to one site. A team that adds a second Bot to an account with a bank tab open has added a second reader to that tab.
What does the model receive when the Bot opens the bank tab?
The tab renders a page, and the model works from the page. The Bot navigates, the site draws the account, and the model's input is what the site drew, the balance, the account number, the payee list and the recent transactions beside them. Whether the page arrives as text or as a screenshot changes the format and not the set of values. Grok Bot is one of the 9 of 15 AI agents whose pages document keeping passwords or credentials away from the model, and 0 of the 15 describe doing the same for the customer data a working page displays (Do AI Agents Ask Before Making a Payment?).
The research record treats that input as untrusted. A design-patterns paper for agents proposes "principled design patterns for building AI agents with provable resistance to prompt injection," and its rule is that once an agent ingests untrusted input, "it must be constrained so that it is impossible for that input to trigger any consequential actions" (Beurer-Kellner et al., 2025). A bank page is both halves at once: the values are the data the task wants, and the page is also where text from outside arrives, in a memo line or a payee reference.
The signed-in state is what makes the reading consequential. A signed-out browser sees the bank's public pages; a signed-in one sees the account, and the difference in exposure is the session, not the page (Can a Browser Agent Read My Session Cookies?). For the bank tab, those fields are the balance, the account number, the statement links and the payee records, and each one can travel into a later step of the run.
What do the vendors themselves say?
xAI's page states the sharing in one sentence: "All of your Bots use the same cloud computer, sharing its files, browser sessions, and app logins" (xAI, 2026). That sentence is what makes a session portable between Bots, and the page states no per-site limit on what a session reaches.
OpenAI's ChatGPT Work admin FAQ describes a different layer, the record a hosted agent leaves. Its Compliance Logs Platform "retains data for 30 days," and the same page says the records "don't establish a complete audit trail" for every browser interaction, tool call or approval (OpenAI, 2026). That is a vendor stating the limit of its own log.
Salesforce's Agentforce documentation shows what a fuller trace looks like: session tracing records "every step of an Agentforce agent interaction: turns, messages, LLM calls, actions, metric scores, and feedback" (Salesforce, 2026). The trace covers the agent's steps, and it does not say whether the values a page rendered are in the export.
| Dimension | What the vendor documentation states | What a buyer should verify |
|---|---|---|
| Where the work runs | Each Bot works on "a persistent cloud computer with a browser, filesystem, and terminal" (xAI, 2026) | Whether a Bot can be given its own computer |
| Sessions | "All of your Bots use the same cloud computer, sharing its files, browser sessions, and app logins" (xAI, 2026) | Which sessions are open on that computer |
| Isolation | "between users, isolation is strict" (xAI, 2026) | That the boundary is the account, not the Bot |
| Site scope | No per-site limit on a browser session is stated (xAI, 2026) | Whether a session can be limited to one site |
| Record, hosted agent | Compliance Logs "retains data for 30 days"; records "don't establish a complete audit trail" for every browser interaction (OpenAI, 2026) | What one run's record contains |
| Trace, another product | Session tracing records "every step of an Agentforce agent interaction" (Salesforce, 2026) | Whether the export carries screen values |
Read together, the three pages answer two questions and leave the third open. The machine is shared and the sessions are shared, which is documented; a hosted agent's log has a retention limit, which is documented; and a step-by-step trace exists in another vendor's product, which is documented. None of them states that the values a bank page renders are replaced before the model reads them, which is the point a review has to settle for itself.
Who approves a Bot's first sign-in, and what record survives it?
Grok Bot's documentation describes the machine, the browser and the shared logins, and it does not describe an approval step between a Bot and a signed-in site or a per-run record of what the model read (xAI, 2026).
A whitepaper on governing agentic systems asks that "at least one human entity is accountable for every uncompensated direct harm," and a Bot acting under an account owner's login puts that accountability on the owner without giving them a decision (Shavit et al., 2023).
The record is the other half. AWS's guidance asks that "audit logs attribute every action unambiguously to either an agent or a human actor," and a Bot browsing through the owner's session makes the two indistinguishable in the log the bank keeps (AWS, 2026). The AI Agent Index entry for Gemini Enterprise records approval requirements for decision types as "None" and notes that users can pause or stop an agent (AI Agent Index, 2026), and pausing a run is not approving a transfer.
Who decided to put the account on the computer matters too. The Cloud Security Alliance reports that "Eight in ten employees use AI tools not approved by their organizations," so the account with the bank tab may never have been in a review (Cloud Security Alliance, 2026).
The control class answers both halves: a named person approves the first sign-in and the transfer, and the record carries what the model read before the approval. A form filled with values the model never sees makes the approval mean something, as Can a Browser Agent Fill In a Form Without Seeing the Values? shows.
What does a governed environment change?
A governed environment changes the answer where the values appear. The page is drawn with consistent tokens in place of the values a policy names, so the bank tab renders ACCT_001 for the account number and PAYEE_004 for the payee, and the model reads the page as it reads any other page, except that the account data is not in it. The session still authenticates the run; what changes is what its pages show the model.
Real values resolve only at the approved destination, at the moment of an approved action, so a transfer instruction carries the real account number only when a named person releases it. That person approves each consequential action, for this record the first sign-in to a new payee and the transfer itself, and every screen, action and approval lands in a record the organization can export.
The scope is the rendered page: a value the Bot reads from a file, a terminal, an API response or an MCP tool is outside this control, and a session that is already signed in stays outside it. The design meets the session question where it is decided, by keeping the values the model reads from being the real ones, the mechanism What Is Render-Layer Tokenization? defines. The comparison for this vendor sets that design beside the machine-level controls: RedactSure vs Grok Bot: 2026 Comparison & Alternative.
What the record shows
Which values the model receives is decided on the rendered page, and the bank tab shows the mechanism. The Bot inherits a signed-in session, the bank draws the balance and the account number, and the model reads what the page drew; xAI documents the shared computer and the shared browser sessions and states no per-site limit on either. The conclusion is narrow: the session is the credential a review has to account for, and a control on what the page may show the model is the one that changes the exposure. Run the test on one tab: open the bank page in the browser a Bot will use, ask for the balance, then compare the fields the page rendered with the fields in the transcript or screenshot the run left behind. The difference is the exposure.
Methodology and limitations
A bank tab describes a record type, not an organization. This page rests on xAI's Grok Bot documentation, a governance whitepaper, two research preprints, vendor documentation from OpenAI and Salesforce, AWS guidance, a research dataset and a research note, and existing RedactSure research pages. Vendor pages were read as of October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where a product applies its control, and xAI's page stops at the machine and the sessions on it.
None of the products on this page was tested for this page, and the statements about them come from documentation; not described means the pages reviewed. Vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Does Grok Bot use my logged-in sessions?
Yes, where a site is already signed in on the computer the Bot uses. xAI's documentation says all Bots on an account share the same cloud computer, its files, browser sessions and app logins, and the page states no per-site limit on what a session reaches. A Bot added to the account therefore opens a signed-in page without a password. The question to put to the vendor is which sessions are open on that computer today.
Can one Bot read another Bot's browser sessions?
On the same account, yes, because the documentation says the Bots share one machine. A session one Bot created is available to the next, and the page draws isolation between users rather than between Bots. A second Bot is a second reader of every open account. A team that needs a boundary between Bots has to create it outside the product, with separate accounts or separate computers, and should check the account roster before adding a Bot that holds a bank login.
Does a logged-in session limit what a Bot can read to one site?
Not from the documentation reviewed. It describes browser sessions as one shared asset of the computer, alongside files and app logins, and says nothing about a session scoped to one domain. A browser profile holds one jar of sessions, and a profile shared by every Bot exposes every site in it. The practical test is to list the sites signed in on that computer and treat each one as reachable by every Bot on the account.
What record shows what a Bot did with my session?
Not a complete one, from the pages reviewed. xAI's documentation describes the machine and the sharing and does not describe a per-run export of what the model read. Hosted agents show the range: OpenAI's Compliance Logs retain data for 30 days and its FAQ says the records do not establish a complete audit trail, while Salesforce's tracing records every step of an agent interaction. Ask which of those your vendor will hand over.
Who approves a Bot's first sign-in to a bank?
No named approver is described in the pages reviewed. The documentation covers what the machine holds and who shares it, not a decision point before a Bot opens a signed-in page. Approval research treats a human gate as one way to limit serious failures, and AWS asks that logs separate an agent's actions from a person's. Those are the requirements to write into a review, because the product's pages do not supply them.
Would signing out end a Bot's access?
Yes, for the site that is signed out, and only for as long as nobody signs in again. The session is the credential, so removing it removes the access the Bot was using. The limit is operational: every Bot on the account, and every person who uses that computer, has to keep the site signed out, and nothing in the documentation reviewed enforces that. A policy that depends on a habit is worth writing down.
How RedactSure Keeps a Bank Tab Out of the Model's View
A shared session keeps the account signed in, and every control over where a Bot may go leaves the page's values in view. xAI's page says all Bots share the computer's browser sessions and app logins, which is the arrangement this control class answers.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the tab renders in the shared browser and the balance, the account number and the payee list enter the model's context with the page. Inside, the same tab is drawn with ACCT_001 and PAYEE_004, the Bot does the task it was given, and the real number resolves only at the destination the account owner approved, with the screen and the approval in the record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A bank tab that renders once keeps its account number in the model's context. Bring one page from your own workflow and see, with test values, what the model reads, who approves and what the record holds. Book a demo