Ten Bots Signed In as Me.

I have been running ten Grok Bots since Saturday. The most useful one is a chief of staff. The least useful ones are the three I stood up to help with engineering.

That is the reverse of what I expected, and the reverse of what agent products are sold on.

Disclosure first. I pay Grok, Claude, ChatGPT and Perplexity, so xAI is one of four vendors taking my money and I am not neutral about any of them. I also sell AI implementation work, which means a post about where agents actually pay off is a post that sells what I do. Check every part of it against your own tools instead of taking my word.

The Roster, and What Has Actually Paid

Ten bots: CMO, Delivery, Chief of Staff, Socials, Finance, CRM, CISO, Monitor, Arch and QA.

Chief of Staff is the one I would not give up. Daily briefings, and it keeps me on the thing I said mattered instead of the thing that showed up in my inbox at nine. CRM and CMO have both earned their slot. Socials drafts case studies and posts them after I approve, which is the part I always let slide.

Arch, QA and Delivery are the three I built for the engineering side of the business. Five days in, they have given me almost nothing I would have missed.

Finance, CISO and Monitor have not been running long enough for me to say anything honest about them. Five days is a data point, not a verdict.

The pattern in the four that worked is not subtle. Every one of them does coordination work that had no system behind it at all. There was no process for the daily brief. There was no process for turning finished engagements into case studies. Anything beats nothing, so anything won.

The Coding Gap Is the Finding

The engineering work is the opposite. That work already sits inside a repository, a test suite, a review process and a build pipeline. It has thirty years of tooling wrapped around it. An agent showing up there has to beat a system that is already good, and mine did not.

Agents get pitched hardest at engineering because that is where the buyers are and where the demos look best. My experience is that the value showed up in the parts of the business nobody makes demos about.

If you are evaluating this, that is where to point it. Find the work in your company that runs on somebody remembering to do it. That is the soft ground.

Every One of Them Signs In as Me

Here is the part that matters more than any of the above.

Grok Bot ships with a catalog of about 220 plugins and none installed by default. When there is no integration for the tool you need, xAI's own documentation says the bot operates through a browser. It signs in and clicks, the way a person does.

Read that again with a security hat on. An API key can be scoped to specific permissions, rate limited, expired, revoked and attributed to a non-human identity. A browser session logged in as me can do none of those things. It has whatever I have, for as long as I am logged in, and the audit log on the far end records a human.

So when my Socials bot posts, the record says Jason Oglesby posted. When something goes wrong at three in the morning, the forensics point at me. Not at an agent, not at a service account, at me.

I am not describing a hypothetical. The system that publishes this post signs into my LinkedIn and my X accounts as me. I built it that way because there was no other way to build it.

Agent identity has been an open problem all year. UI-level authentication is not a solution to it. It is a decision to stop trying.

They Also Share a Computer

The bots on one account run on a shared virtual Linux machine. xAI states plainly that they share the same files and logins, and that separate bots are not separate security sandboxes.

That means the blast radius of my ten bots is one blast radius, not ten. My CISO bot and my Socials bot are sitting on the same box with the same credentials, and the only thing separating them is instructions.

To xAI's credit, they say this out loud. Their guidance recommends disconnecting plugins when you are done with them and keeping bots in low-risk read-only situations. That is unusually honest for a launch, and it is also the most useful line in the documentation. When a vendor tells you to unplug their product when you walk away, believe them.

On compliance they hold SOC 2 Type II, address GDPR, and run annual penetration testing. No ISO certification yet. That is a reasonable posture for a beta product and it does not change the architecture underneath.

What I'd Do This Week

Point agents at the work with no system behind it. Not the code. The coordination, the follow-ups, the reporting nobody owns. That is where mine paid.

Find out what your agents are authenticating as. If the answer is a browser session on a human account, your audit trail is naming the wrong actor and you should know that before an auditor tells you.

Stop treating multiple bots as multiple boundaries. If they share a machine and share logins, you have one boundary with ten front doors.

Keep the approval gate. Mine posts nothing without me. Five days of good behavior is not evidence of anything.

The Part That Matters

The useful thing I learned in five days had nothing to do with the model. It was that the work most exposed to agents is the work I never built a system for.

The uncomfortable thing I learned is that ten of them are signed in as me, and every system they touch believes it was me.

That is not a Grok problem. That is where all of this is heading.