Grok Bot Vault: Saved Logins and Cards the AI Never Sees, and the No-Approval Catch

Grok Bot now has a Vault: a place to save logins, payment cards and contact details so the bot can sign in and check out for you, with documentation saying the AI never sees the secret values. The help page says Vault "keeps your logins, cards, and contact info so your Bot can sign in to sites and check out for you without seeing the secret values," and requires Grok Bot 0.75.2 or later. The catch, also in the docs: a saved card is used at checkout "without a separate approval each time."

This post sticks to what the official secrets help page and security documentation state, flags what they leave open, and gives a safe-use checklist. It continues our coverage of the product, including the bot's own email address and approvals in 0.70.2, the bank-balance Slack incident over agent permissions, and model routing.

Quick reference: what the docs say

Agents that act on your behalf need rules. Agentbeam stops the dangerous actions →

How does Vault work in practice?

You open Settings, choose Vault, then New item, and pick Login, Card or Contact info. For a card you can scan it with the camera, upload a photo or type it in. Each item has optional Hints, such as "Use for work purchases," which the Bot follows when it chooses between entries.

When the Bot needs a credential, the sequence in the docs is: use a saved login first, then a connected password manager such as 1Password, and otherwise ask you with a Secure Form. If the Secure Form has the "Securely save to Bot's vault" box checked, the value is kept for next time. If it is unchecked, the value lives only for that chat and expires.

If you let the Bot choose a password when it signs up for a site, Vault generates and saves the login, and the Bot never sees it. Details you share in chat, such as a name or address, are saved as contact info once the task is done, and the Bot tells you what it saved.

Vault door with a key hanging beside it, representing Grok Bot Vault storing logins and cards

How is the model kept away from the secrets?

The security documentation describes the design: saved values are "filled into the page by reference: the model never receives a saved password, card number, or security code, or what the member types in a Secure Form." OAuth tokens for connected apps stay on the vendor's backend, so the model sees tool results, not tokens. For single sign-on, passkeys and other steps a form cannot handle, the Bot hands the computer to you.

Saved values are write-only. In Settings, passwords stay hidden and cards show only their last four digits. After you save an API key through the secure secret card, it is not shown again, and the footer reads that it is "never shown to your Bot." A blank field later, the docs warn, is not proof the secret was deleted.

This matters because the usual failure mode for agents is leakage through the transcript, a log or a prompt injection that coaxes the model into repeating what it can read. A design where the model cannot read the secret removes that path. It does not remove every path: the Bot still acts as you, can use the credential, and can be tricked into using it somewhere harmful.

What is the approval catch?

The page on saved cards is blunt. Saving a card "lets your Bots fill it in at checkout, and there's no setting that requires your approval each time a saved card is used." The security page repeats it: members who want to approve each payment should not save the card.

That is a meaningful gap. The Bot has a separate approvals system and an Auto Review layer, described as "an independent review model that evaluates risky Bot actions before they run," and the docs say it can proceed, require approval or deny. But the same page says Auto Review does not review every side effect, and recommends treating it as a complement to explicit boundaries. The Vault page does not say Auto Review gates card use, and it says plainly that no setting forces approval. Until that changes, a saved card is a standing authorization.

Card tapping a payment terminal, representing an AI agent paying at checkout with a saved card

What else should you know?

• Every Bot shares the vault. Everything you save is available to every Bot on your account, and you cannot limit an item to one Bot. If you run a Bot for experiments and another for purchases, both can use the same card.
• Shared Bots are excluded. For team Bots, keys go under Secrets, which are used in every teammate's chat, so add only keys you are happy for everyone with chat access to use.
• Bots act as the signed-in member. The security page says a Bot cannot hold more access than its owner and that actions stay attributable to a named member.
• Computers persist data. Each member's hosted computer keeps files and browser sessions on a durable disk, and deleting a Bot does not remove computer files or browser sessions. Secrets typed into files or shell profiles can persist or vanish on reset, which is why the docs say not to keep copies there.
• Phone limits. On the phone, saved cards cannot yet be edited; remove and re-add.

What is not confirmed about the release?

Two things are murky. First, the docs set the floor at 0.75.2, but they do not give a release date, so we cannot say exactly when Vault shipped. Second, we did not confirm the version that first shipped Vault from an official changelog, so treat any other version number you see attached to it, or to related features such as outbound calling, as unverified until the changelog says so.

Who should and should not save a card?

The trade-off depends on what you ask the Bot to do. For recurring, low-value tasks such as renewing a subscription or reordering supplies, a saved card removes friction, and the Hints field lets you steer the Bot toward the right entry, for example "Use for work purchases." For one-off or high-value purchases, the Secure Form with the save box unchecked is the better fit: the value lives only for that chat and expires, so nothing stays behind as a standing authorization.

Logins sit in between. A saved login lets the Bot return to a site without asking, but it acts as you, so anything your account can do on that site is in reach. Because the vault covers the whole account and cannot be limited to one Bot, it helps to save only what every Bot on the account should be allowed to use.

How to use Vault safely: a checklist

1. Decide per card. If you want a human gate on money, do not save the card. Leave the save box unchecked on Secure Forms.
2. Use a limited card. If you save one, use a virtual or low-limit card with merchant controls from your bank.
3. Prefer a password manager for sensitive logins. The docs say the Bot falls back to a connected manager such as 1Password, which can approve individual fills.
4. Write boundaries into the request. The security docs suggest telling the Bot what it may change and where to stop, for example to show the current and proposed value and ask for approval first.
5. Delete CSV imports. The exported file holds passwords unencrypted. Delete it after importing.
6. Review saved items. Open Settings, Vault, and remove cards and logins you no longer need; removal immediately stops the Bot using them.
7. Add a monitoring layer. Agent-action review tools such as AgentBeam, from the explainx.ai team, exist to stop agents before they take dangerous actions, which is the control Vault itself does not provide for payments.

Why does this matter beyond one product?

Agents that can complete a purchase need two things: a credential and permission. Vault solves the first well, by keeping secrets out of the model. It leaves the second to the user. That split is likely to become the standard debate for agent products, and it echoes the lessons from the earlier permissions incident and the broader comparison of proactive agents. The practical rule is simple: the less standing authority you give an agent, the smaller the damage from a mistake, a bug or a manipulated page.

Related reading

• Grok Bot gets its own email address: 0.70.2 and approvals
• Grok Bot bank balance Slack post and agent permissions
• Grok Bot model routing to Claude Opus 5.5, Midjourney and Suno
• Claude Duet vs OpenAI dots vs Meta Muse vs Grok Bot
• A solo founder's week with Grok Bot
• Rakazo: an open-source Grok Bot alternative

Details reflect the vendor help and security documentation read on October 28, 2026; versions and settings may change.