xAI Launches Grok Bot in Beta: Pricing and Uses

xAI launched the beta version of Grok Bot on August 11, 2026, a service featuring agents each equipped with a cloud machine, web access, and plugins to operate within applications. Pricing is per seat and usage-based, with a 7-day trial, guided installation, and multi-agent collaboration: here’s an overview, including a practical case that uncovered four bugs, including an XSS vulnerability.

A Use Case Reveals Four Real Bugs, Including an XSS Vulnerability

During a test, a Grok Bot agent utilized an online application and examined the source code, which led to the identification of four concrete bugs. Among them, deselecting a hero resulted in the deletion of the quest log due to a validation error, and displaying names via unsafe_allow_html exposed the system to code execution, constituting an XSS vulnerability that must be reported. Two other issues involved the absence of a defined model for ChatOpenAI and exception handling and quotas via before-except generating raw traces. Prior to these findings, the agent had selected the wrong repository and found no open tickets across four repositories, then was redirected to the correct one, where it detected an online Streamlit application and the local startup procedure (pip install -r requirements.txt, key in .streamlit/secrets.toml, streamlit run dnd.py on port 8501). The mission shifted from reproduction to bug hunting, with the tracking being empty, and the multiplayer configuration sometimes required two simultaneous clients for testing.

Each Agent Has a Cloud Machine Capable of Acting

Grok Bot assigns each agent a cloud computing machine, which can be used to browse the web and execute commands. The bot connects to applications and performs tasks, delivering the work to the appropriate location. The service is not limited to a text interface and can be used from a desktop client or iOS.

Access and Pricing: No Free Tier, 7-Day Trial, and Usage Fees

No free offer is available for Grok Bot. The free version of Grok allows for about ten requests every two hours but does not provide access to the bot, which requires a prior paid subscription. Several tiers are offered, including Cursor Teams Standard (with shared billing and management), Cursor Teams Premium (with higher permissions per user), and Grok 4 Heavy for parallel computing, as well as strict access permissions and a tier for standard use. Prices have already been modified once, and it is recommended to check the pricing page before subscribing. A free 7-day trial is available, requiring a credit card, which will not be charged until the eighth day. Billing is done per seat, separate from the total invoice amount, and usage is limited by a weekly cap, with token fees for exceeding limits.

Getting Started: Simplified Installation and Account Settings

The installation of Grok Bot is presented as straightforward, with no configurations or command lines, via an app store or download from the x platform, for any compatible platform. Users must log in with a paid account, and any account change requires recreating the agents. It is then necessary to check the plan and switch to Grok Bot if eligible, while SuperGrok clients can continue their usage. Configuring an agent involves setting the name, color, shape, type, a description, and connecting plugins in the settings. For GitHub, the plugin requires a personal access token to be entered in a dedicated field and kept secret; writing this token in a chat is a mistake as the message resides on a cloud server accessible to bots. For testing, the scope must be restricted to the targeted repository with read/write permissions for Issues and read-only permissions for Metadata, as the code is not necessary to reproduce interface errors.

Automation and Coordination: From Framing to Groups of 2 to 6 Bots

The Grok Bot ecosystem relies on three elements: skills, which are the instructions to accomplish a task; routines, which trigger execution; and plugins, which allow access to services like Slack, GitHub, or messaging. A good mastery of these components enables autonomous operation; otherwise, supervision is required. Agents can be grouped in discussions, with two to six participants, to pass work among themselves. An account health bot can thus identify a client affected by session issues after an update and relay the hosting date to a QA bot. In practice, the initial framing is crucial: an agent created for bug reproduction had to be specified precisely, relying on six sections described in xAI's documentation and a validation and approval process aimed at avoiding overly confident erroneous claims.