AI News5 min

Grok Bot in October 2026: Pages, Vault, Bot email, shopping cards and proactive Bots

Third note in our Grok Bot series: Bots get their own email address, a Vault for logins and cards, editable Pages, video, shopping cards and a primary Bot that proposes work. More autonomy, so re-check your approval gates.

Erhan Timur29 October 2026Founder, Digital by Default

Share:X LinkedIn

Grok Bot in October 2026: Pages, Vault, Bot email, shopping cards and proactive Bots

Third note in our Grok Bot series. The August launch note covered what a Bot is. The September update covered plan expansion and the Enterprise tier. October is about the Bot doing more on its own: its own email address, a Vault for logins and cards, editable Pages, video, shopping, and a primary Bot that proposes work before you ask.

Each of those widens what a Bot can touch. That is good for throughput and worth a fresh look at your approval gates.

What shipped in October

From xAI's release notes and the unofficial changelog that tracks them:

Bot email addresses and a proactive primary Bot (2 to 9 October)

Each Bot can now have its own email address. Forward a supplier invoice, a candidate CV or a customer complaint and the Bot picks it up as work. Your primary Bot (marked with a star) also now spots work it could take on and offers to do it, rather than waiting for a prompt.

Operator read: inbound email is the most common way untrusted content reaches an agent. A Bot that reads mail and then acts in your browser needs the same scepticism you would give a new starter opening attachments.

Pages and video (22 October, 0.75.2)

Bots can build Pages: editable documents such as reports, dashboards and briefs that live in the Grok Bot app. The same release added video creation. For teams using Bots for weekly reporting or board packs, Pages replaces the "paste it into a doc" step.

Vault, email forwarding and fewer approval cards (23 October, 0.75.5)

The Vault lets a Bot store logins, payment cards and contact details in Settings and use them to sign in or check out. The same release added email forwarding and reduced the number of approval cards a Bot throws up.

This is the release to read twice. A Bot with stored card details and fewer approval prompts is a Bot that can spend. Decide before you add a card, not after.

Shopping cards (27 October, 0.78.1)

Product results appear as cards with photos, ratings, prices, store names and up to two badges such as "Top rated". With Vault, the path from "find me a replacement label printer under £150" to a placed order is short.

Connectors and notifications

New connectors in October include Trello, PostHog, beehiiv, Coinbase, Robinhood and eToro. Alerts now go only to the device you are using rather than every device at once.

The caveat that has not changed

xAI's own documentation says that Bots on one account share a computer and should not be treated as a security boundary between each other, even though the product page talks about each Bot having its own. With Vault in the picture, that matters: a credential available to one Bot's environment is available to the others on the same account. Enterprise's per-user isolation addresses the user boundary, not the Bot-to-Bot one.

What to re-check before you turn these on

Vault scope. Which logins and which card, if any. A prepaid or low-limit virtual card is the sensible default for a Bot that can check out
Approval gates. "Fewer approval cards" is a product improvement and a policy decision. Keep human approval for spend, outbound email, CRM changes and anything customer-facing
Inbound email. Treat the Bot's address as a public inbox. Decide what it may act on from a forwarded message and what it must only summarise
Proactive suggestions. Nice in a demo; in practice, agree who may say yes to a Bot's offer of work and where the record of that yes lives
Pages ownership. If a Page becomes the board report, someone human owns its accuracy
Connector sprawl. Coinbase, Robinhood and eToro connectors exist. Most UK businesses have no reason to enable them. Allow-list connectors per Bot

Grok Bot vs the alternatives in October

Need	Prefer
Standing agent that works across portals, inbox and documents	Grok Bot
Deterministic workflow with retries, audit and node-level governance	n8n, including its new Browser Use step
Enterprise agents grounded in company knowledge with permissioning	Dust, see our autumn update
Voice front door on the phone	A voice stack; see build or buy a phone agent

Bottom line

October made Grok Bot more autonomous: it can receive work by email, hold credentials, spend, publish documents and suggest its own next job. For an ops-heavy small team that is a real step towards the "digital colleague" pitch. It is also the month to write down what a Bot may and may not do with a card and an inbox. Pilot with a virtual card, an allow-listed connector set and approval kept on anything outbound, then widen.