Your Agents Share One Set of Keys.

SpaceXAI shipped a product this week that runs your software for you, unattended, by clicking through the screen like a person would.

Then it published this line in the documentation: "Do not use separate Bots as a security boundary."

Read that again, because it is the most honest sentence any AI vendor has written this year, and almost nobody buying the product is going to see it.

The Demo Sells Separation. The Docs Sell the Truth.

Grok Bot opened in early beta on August 11. The pitch is persistent agents that operate any browser-based application without an API, keep working after you close your laptop, and pick the job back up where they left it.

The mental model that pitch creates is a team of coworkers. One handles invoices. One handles the CRM. One does research. Separate people, separate desks, separate access.

That is not the architecture.

Every bot on your account shares one cloud Linux machine. One browser cookie store. One filesystem. One set of command-line credentials available to every bot you create. SpaceXAI states the implication directly: the screens are separate work surfaces, not separate security boundaries.

So if the invoice bot signs into your banking portal, the research bot is already inside that session. Not because anything failed. Because that is how it was built.

Persistent Means the Credentials Persist Too

The word doing the damage here is persistent.

We have spent two years thinking of AI as a request and a response. You ask, it answers, the session ends, nothing is retained. Whatever access it had evaporated when the tab closed.

Persistent agents break that assumption completely. The session does not end. The cookies stay warm. The authenticated state sits in a virtual machine that keeps running whether you are at your desk or asleep.

AWS made the same move on August 6, extending Bedrock AgentCore sessions from 8 hours to 14 days. Different vendor, same direction.

An agent that stays logged in for two weeks is not a feature. It is an identity in your environment with credentials, a spend rate, and no HR file.

Approval Is Not a Rollback

The comfort blanket everyone reaches for is the approval prompt. The agent asks before it does something consequential, a human says yes or no, and control is preserved.

SpaceXAI is honest about this one too. Approvals govern proposed actions and do not reverse work already completed.

That distinction is everything. An approval gate stops the next step. It does nothing about the eleven steps that already ran, the files already written, the message already sent, the record already changed.

If your entire agent governance plan is a human clicking approve, you do not have a control. You have a witness.

The Precedent Is Six Weeks Old

In July, Grok Build CLI uploaded entire codebases to cloud storage, roughly 27,800 times more data than the task required, including unredacted API keys and database passwords pulled from .env files. The privacy toggle users assumed protected them only governed whether the data trained a model. It did not stop the upload.

I am not raising that to dunk on one company. Every vendor in this category is shipping fast, and the same class of mistake is going to show up in products from companies you like better.

I am raising it because it shows what the failure mode actually looks like. Not a model going rogue. A tool moving more data than anybody expected, into a place nobody reviewed, with credentials nobody scoped.

What I'd Do This Week

Read the security documentation before the pricing page. The Grok Bot boundary language is public and plainly written. Most teams evaluating this product will never open that page. Be the exception.

Give every agent its own identity, or its own account. If the platform will not isolate agents from each other, isolate them at the account level. One account per trust domain. Yes, that costs more.

Scope credentials to the job, not the person. An agent doing invoice reconciliation does not need the same access as the human who set it up. Least privilege, short expiry, separate identity, logs somebody actually reads.

Write down what an agent may never touch. Payroll, production databases, customer PII, outbound email to clients. Put it on paper, attach a name to it, and enforce it in the credential scope rather than in a prompt.

Assume approval is a speed bump. Design so the worst thing that can happen before a human intervenes is survivable. That is a scoping decision, not a UI decision.

The Part That Matters

The vendor told you where the boundary is. It is in the documentation, in plain English, and it says there is no boundary between your agents.

That is not a scandal. That is a disclosure most companies would have buried.

The scandal would be reading it, buying anyway, and giving all of them the same keys.