Grok Bot Safety: What to Never Share With a Bot
Quick answer
A Grok bot only sees what you paste or type into it. Never share passwords, one-time codes, full card numbers, or other people's private data. Redact account numbers from statements, remember bot creators may see usage, and report harmful bots to the directory within minutes.
Grok bots are convenient precisely because they're focused - and focused bots invite focused oversharing. This guide draws the practical lines: what's fine to paste, what's never fine, and how to sanity-check a bot before you trust it with real work.
The mental model
Treat every bot conversation like email to a smart stranger. Grok (the model) processes your input to generate the response, and depending on the platform's settings, the bot's creator may see usage or reported conversations. Assume anything you paste could be read by a human - because one day it might be.
Never share, no exceptions
- Passwords, API keys, and one-time codes - no legitimate bot needs them.
- Full card numbers or bank credentials - amounts and merchant names are enough for any money task.
- Other people's private data - your coworker's medical leave, your client's unreleased numbers.
- Anything you'd be uncomfortable seeing quoted in public.
Safe with light redaction
Most listing tasks work fine with redaction: invoices with account numbers masked, purchase histories with card digits stripped, calendar entries with attendee names initialled. The bots in our Money and Productivity categories are designed around this - they tell you exactly which fields they need, and it's never the secret ones.
Evaluating a bot before trusting it
- Read its instructions if published - vague bots with god-mode claims get flagged by reviewers.
- Check what it asks for: bots that request the minimum are built by people who thought about privacy.
- Watch the refusal: paste something out of scope. A bot that refuses cleanly is a good sign.
- Check the builder: real profiles with other focused bots and visible history are a good signal.
If something goes wrong
Broken, misleading, or harmful bot? Report it to us (we delist within 24 hours of a verified report) and to xAI. Stop using a bot the moment it asks for credentials - that's not a feature, that's a red flag wearing a feature costume.