Grok Bot vs ZeroClaw

Grok Bot

Connector tokens stay on Cursor's backend and each user gets a separate microVM, with approvals, drafts and a review model before risky actions. All of a user's Bots share one computer and its sign-ins, the review model skips memory writes, and the status page shows seven major Grok Bot incidents since 3 September 2026.

ZeroClaw

Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.

Grok Bot

1. State in each request what the Bot may change and where it must stop. Which actions pause for approval depends on the tool, the risk and the owner's Auto-review rules
2. Add narrow Ask first rules for sending, publishing, purchasing and deleting. Ask first wins over Allow automatically when both match
3. Treat any sign-in or file on the cloud computer as available to every Bot on the account. Give a workload its own Cursor user when it needs separate credentials
4. Run Test run with safe inputs. A test run performs real work and can call connected tools
5. To remove access, pause routines, sign out of sites on the computer, uninstall connectors and revoke them at the source service. Deleting the Bot is not enough

ZeroClaw

1. Keep [risk_profiles.<alias>] level = "supervised". full runs every tool not listed in always_ask, and the YOLO preset removes the sandbox and path rules too
2. Add sending and account tools such as send_via, google_workspace and http_request to always_ask so a session-level Always grant cannot skip the prompt
3. List senders in [peer_groups.<name>] external_peers. ["*"] accepts anyone on that channel
4. Set [web_fetch].allowed_domains and [http_request].allowed_domains. Fetches run unprompted and the OS sandbox does not block egress
5. Run one-shot tasks with zeroclaw agent -a <alias> -m "<task>". A cron or webhook turn has no prompt, so shell calls fall to the command policy