Grok Bot vs nanobot

Grok Bot

Connector tokens stay on Cursor's backend and each user gets a separate microVM, with approvals, drafts and a review model before risky actions. All of a user's Bots share one computer and its sign-ins, the review model skips memory writes, and the status page shows seven major Grok Bot incidents since 3 September 2026.

nanobot

nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.

Grok Bot

1. State in each request what the Bot may change and where it must stop. Which actions pause for approval depends on the tool, the risk and the owner's Auto-review rules
2. Add narrow Ask first rules for sending, publishing, purchasing and deleting. Ask first wins over Allow automatically when both match
3. Treat any sign-in or file on the cloud computer as available to every Bot on the account. Give a workload its own Cursor user when it needs separate credentials
4. Run Test run with safe inputs. A test run performs real work and can call connected tools
5. To remove access, pause routines, sign out of sites on the computer, uninstall connectors and revoke them at the source service. Deleting the Bot is not enough

nanobot

1. Set tools.restrictToWorkspace to true and tools.exec.sandbox to bwrap or seatbelt before giving it real accounts. Both are off by default
2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)
3. Keep allowFrom narrow on every channel and never set ["*"] on Email, which has no pairing
4. Write secrets as ${VAR} references in ~/.nanobot/config.json. Plain values are stored in clear text
5. Use nanobot -m "..." for a one-shot run, and keep nanobot gateway running for channels, schedules and heartbeat