Grok Bot Shared Bank Balances in Slack — Pricing Impact

A read-only bank connection did not make the output read-only. In a first-person account published by Business Insider, XMTP Labs CEO Shane Mac said his Grok Bot “CFO” agent had read-only access to his personal checking and savings accounts. On October 1, its monthly report went to a company Slack executive channel instead of his private Grok Bot group chat. The report included balances and spending details. Mac said he deleted the post and disconnected his integrations.

This is a reported individual incident, not an independently audited breach report. Mac attributed the error, after a Grok-team investigation, to similarly named group chats and shared connections across his Bots. He also said the team shipped an additional cross-channel permission step; we have not independently verified its deployment or scope. The account describes balances and expenses, not published account numbers or stolen funds.

How could a personal agent post to work Slack?

Mac described a private group named “My Personal Exec Team” and a company Slack group named “Exec-team.” His CFO Bot was instructed to message only the private group, but a Slack connection added for another Bot was available to the shared environment. The destination mistake crossed a personal/work boundary even though bank access itself was read-only.

That shared-access behavior is consistent with xAI’s Grok Bot FAQ: all Bots under one user share a persistent cloud computer, files, browser sessions, and logins. xAI explicitly says not to use separate Bots as a security boundary. Its team guide says a permitted connector is available to every Bot a member runs. The incident does not prove every account is configured identically; it shows why users should inspect the effective connected-account and destination permissions before scheduling finance workflows.

What does this change about Grok Bot pricing?

No official Grok Bot price or xAI API rate changed because of this report. Grok Bot is a managed cloud-computer agent, not an API model ID. The current official Grok Bot FAQ says access is included with paid individual Cursor plans and Cursor Teams, or through linked individual SuperGrok tiers; eligible accounts get weekly usage and may add on-demand usage billed from the serving model and tokens. Cursor’s current plan matrix gives the wider eligibility list and explicitly excludes SuperGrok Lite. It does not publish a standalone per-Bot price or a universal weekly allowance.

The live table above is xAI public API pricing for developers building a separate agent; it is not a quote for a Grok Bot incident or its automatically selected model. For API calls, xAI’s official rate card lists Grok 4.7 at $2 input, $0.50 cached input, and $6 output per million tokens below 200,000 prompt tokens; Grok 4.3 is $1.25/$0.20/$2.50. Larger prompts use the published higher tier. We verified those rows against the canonical xAI pricing page and API feed on October 10. The canonical and API pricing files remain unchanged because the incident is not a rate-card event.

The economic comparison is cost per safely completed workflow: plan or API usage, repeated runs, human approval time, and any remediation cost. An apparently cheaper unattended report can be expensive if its destination must be investigated and access revoked. That is a risk-cost observation, not a claim that xAI levied an incident fee.

A practical control checklist

1. Give finance Bots only the accounts needed for the task; keep personal finance and work messaging under separate user identities when possible. Merely creating a second Bot under one user does not isolate credentials.
2. Make the report a private draft first. Require an explicit approval for every send or cross-channel share, showing the exact destination ID and a redacted preview. xAI’s approval guide recommends narrow “Ask first” rules for sending and publishing.
3. Remove unneeded connectors and sign out of browser sessions on the shared cloud computer. Deleting a Bot alone may leave shared files and logins behind.
4. Test the scheduled routine with lookalike channel names and a harmless fixture. Record whether the final send is blocked, logged, and visible to the owner.
5. If a report reaches the wrong channel, stop the routine, remove access, contain the message with the channel administrator, and follow the organization’s incident procedure. Deletion does not guarantee all recipients or integrations missed it.

For a coding-only task, compare the Z.ai Coding Plan before granting a general-purpose agent banking and workplace connectors. It is not a substitute for Grok Bot’s cross-app finance workflow. We may earn a commission from the sponsored link; it does not affect this analysis.

Labs status: workflow-security replay unavailable

Our Labs coverage notes record an explicit blocker. The maintained 49-task text benchmark can price and score an exact model route; it cannot reproduce a private Grok Bot cloud computer, bank and Slack connectors, channel-name collision, approval state, or disclosure containment. A defensible replay would require authorized synthetic accounts, pinned Bot and connector versions, the same lookalike destinations, complete action and approval traces, repeated trials, a leak/false-positive grader, and full plan or usage plus review-cost records. No model score or incident probability is inferred from Mac’s account.

Bottom line

The useful lesson is about shared capability and destination control, not a new Grok token price. Read-only data access still permits harmful disclosure when a separate messaging connector can send the output. Buyers should verify eligible plans in current Grok subscription pricing, keep API rates separate, and require a reviewed destination before a finance agent posts anywhere.

Sources: Business Insider’s first-person account, xAI Grok Bot FAQ, xAI approvals and privacy guide, xAI team guide, Cursor plans and billing, and xAI developer pricing. Checked October 10, 2026.