Musk says Grok Bot can shop from a photo of your card

Grok BotWhat's new#

No new version is on the changelog. It still ends at 0.68.1 from Oct 7, and Cursor's status page shows no incidents since Friday evening. (confirmed) Mac builds of 0.69.0, 0.69.1 and 0.70.0 are on Cursor's download server, though. (rumor)

• Idle disconnects on the local computer: Your Mac or PC drops offline when Grok Bot isn't the active window. Staff confirmed the pause on Windows on Saturday. (confirmed)
• Background scripts freeze when the Bot's computer sleeps: Staff confirmed it Saturday. (confirmed)
• Copy on iOS garbles non-English text: A fix is ready for a coming update. (confirmed)
• 0.69 and 0.70 builds appear ahead of the changelog: Mac installers are on the download server. (rumor)

Musk says to shop with a photo of your card (confirmed he said it)#

What happened: At 5:04 PM ET Saturday, Elon Musk posted: "To buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok @Bot will scour the Internet for the best deal on the item you want and order it." A minute later, @PEoperator replied "Unfortunately Amazon is blocking @bot now." Musk answered at 5:08 PM ET: "Grok will find another way to buy stuff. I just ordered LEGO and Grok bought it from the LEGO website."

Who is affected: anyone who wants a Bot to buy things. Musk didn't say which plans, countries or safeguards apply, TeslaNorth noted, and the Grok Bot team hasn't posted details.

What the product already does: Grok Bot has a checkout path that keeps your card number out of the chat. The Aug 28 changelog says "When your Bot wants to buy something, a card shows the amount for you to Allow or Deny, then Link completes the payment." Since 0.33.0, "Pay with lets you choose a saved card from your Link wallet." Since 0.68.1, "checkout card fields get a Secure Form instead of a screen handoff." The secrets help page says to "Keep API keys and other credentials out of chat and ordinary files." When a saved secret is filled into a page, "Secret values were never shown to your Bot." That sentence is about saved secrets, not a photo of a bank card.

We didn't photograph a card or place an order. The steps below are the changelog checkout, not a test of the photo method.

Why that matters: a photo is a message, and a Bot's chat history travels with it. Staff member kevinn said on Oct 8 that "every new message is sent together with that history." Our read: a card photo stays in that Bot's chat, where the help center's own advice says credentials shouldn't be.

What to do now:

1. Tell the Bot what to buy and your limit, and ask it to stop at checkout. For example: "Find the best price on {item} under {$amount}. Stop before paying and show me the total, the seller, and whether it repeats."
2. Approve the purchase card only when the amount and seller match. Pay with your saved Link card, or type the card into the Secure Form if the site asks.
3. Don't paste or photograph a card into chat. The help page says to keep credentials out of chat. If a photo is already there, delete that message. Our read: consider asking your bank for a new number. The help page does not say to do that.
4. Check whether the charge repeats. On Oct 9, a user said a Bot signed him up for a recurring meal plan instead of a one-off order.

What to watch: whether the Grok Bot team documents card photos as a supported way to pay, and whether more stores block Bots the way @PEoperator says Amazon does. Our approvals guide has the stop-point wording.

Your computer drops offline when Grok Bot isn't the active window (confirmed)#

What happened: Staff confirmed the "away" pause on Windows. On Saturday at 1:50 PM ET, kevinn told a user whose PCs kept showing offline that the app "pauses the connection your bots use to run commands when it thinks nobody is at the computer." It counts you as away when "The screen locks," "The PC goes to sleep," or "The Grok Bot window stops being the active window." Clicking into a browser with grok.com open counts, "even if Grok Bot stays maximized," and the offline message "can show up later than that."

Who is affected: anyone who lets a Bot run commands on a Mac or PC, especially for scheduled jobs or several machines at once. The same user said "keeping Grok Bot maximized and focused 24/7 isn't realistic." Brandon_Antonelli reported his Mac mini drops even with sleep off, caffeinate running every 4 minutes, and the window in front. (reported)

What to do now:

1. Keep the Grok Bot window as the active window on that computer.
2. Message your Bots from your phone or another device, not from grok.com on the same computer, kevinn said.
3. If a Bot says the computer is offline, click the Grok Bot window. "You don't need to send a message, so there's no need for a script that types 'Hello'." The user replied that his Bots still wait for a message before retrying, so tell the Bot to try again.
4. If your machine drops while Grok Bot is always in front, or on Linux with no sleep or lock, staff want a separate thread. deanrie asked for the app version, OS, and an excerpt from ~/.grokbot/local-exec-daemon.log.

The Bot's own computer sleeps too: "A few minutes after the app disconnects and no bot is working on it, the computer is paused," kevinn said in another thread. Scripts you left running there freeze, and an automatic update ends them. See the known issue and our catch-up tip below.

What to watch: kevinn said, "There isn't a setting to turn this off," and staff will post in both threads when there's an update. gshall installed Tailscale on the Bot's computer to skip the app connection, and deanrie called that "totally valid." (reported) We couldn't try the away pause or the sleep freeze. We don't run the desktop app.

Copy on iOS garbles non-English text (confirmed)#

What happened: Copying a Bot message with Chinese from the iPhone app pastes as accented Latin characters. "A fix is ready and will be included in one of the next app updates," deanrie said at 3:14 AM ET.

Who is affected: anyone copying non-English Bot text in the iPhone app. The reporter said it blocks sharing to WeChat. English text in the same message survives.

What to do now:

1. Long-press the message and choose Select Text.
2. Select the text and tap Copy in the small iOS menu.
3. Don't use the Copy button at the top of the screen. "It gives the same broken result."

What to watch: the App Store update that includes the fix. There is no date. We couldn't test it. We don't run the iPhone app.

Grok BotHow people are using it#

• Search every Bot's messages: Press Cmd+K or Ctrl+K, type a keyword, and put it in quotes to see every matching message with the Bot it came from. On mobile, use search with the Messages filter. Credit: Colin, Cursor forum staff (https://forum.cursor.com/t/grok-bot-search-chat-history/174312/6).
• Bots in the car: On a Cursor plan, the Grok app in your car shows an upgrade screen, so use voice chat in the Grok Bot phone app over the car's Bluetooth. Leave the box empty and press the waveform. Credit: deanrie, Cursor forum staff (https://forum.cursor.com/t/grok-bot-subscribed-with-cursor-how-to-access-in-grok-app/174183/4).
• Pipelines that survive sleep: Have each script save its last good run time and catch up from it, and have your routine restart the scripts if they aren't running. Credit: kevinn, Cursor forum staff (https://forum.cursor.com/t/grok-bot-computer-freezes-reboots-repeatedly-and-kills-24-7-background-scripts/174272/7).

Grok BotThe digest#

Musk's shopping post is the loudest Grok Bot claim of the weekend, and the product already has a safer answer. Bots could buy things before Saturday. Purchases have had an Allow or Deny card with Link payment since late August, and checkout card fields got a Secure Form on Oct 7. What's new is Musk, in a post with more than 30,000 likes by Sunday morning, telling people to photograph their card. Use the purchase card and Secure Form instead, and tell the Bot where to stop. Watch for official word on whether card photos are a supported path, and for more stores following the Amazon block @PEoperator described. (reported)

Early builds: Cursor's download server has Mac installers for Grok Bot 0.69.0 (uploaded Oct 8), 0.69.1 (Oct 9) and 0.70.0 (Oct 10), while the changelog and its Download button still say 0.68.1. We checked the 0.70.0 installer's version ourselves. A Windows user, Parag_Chhibber, says he already runs 0.69.1. Nobody has said what's in either version. A changelog entry is the confirmation to watch for. (rumor)

The local computer story keeps growing. Mac, Windows and Linux users all report Bots losing their computer overnight, and staff now treat two problems separately: the designed "away" pause, and drops on machines that never sleep, lock or lose focus. On Linux, tdeckers found the app sending its local helper SIGTERM and only starting a new one 4 seconds after he touched the machine. Until there's a setting, plan scheduled jobs around a computer that may not answer.

Sign-ins and connectors: Google sign-in through 1Password still fails at the password step, on the full page and the popup. deanrie's workaround is to type the password yourself when the Bot hands you the screen. After that, "the next sign-in should only require selecting the account." Asana on the cloud path fails with "This plugin's OAuth client is not configured," a known issue with no ETA. The local path with your own client ID in ~/.cursor/mcp.json still works.

Desktop glitches: if a chat pane goes blank when you switch Bots, keep Use hardware acceleration on. deanrie said turning it off "usually makes it behave worse," and one scroll or a window resize redraws it. On Linux, David_Stredansky traced the black pane to Chromium's compositor, not the app's state. (reported) Separately, deanrie confirmed there's no reliable way to set or view a personal Bot's role in the new details pane, and advised against a chat workaround because "it doesn't give stable results."

Older issues: the HTTPS-only block on Bot computers is in its eleventh day. Marveltools posted a DNS-over-HTTPS workaround, while davidabrooks said his Bot refused to maintain a similar one because it would be "getting around a safeguard." Staff haven't endorsed either. Scheduled routines still lack an all-clear: Parag_Chhibber said Saturday he still sees missed runs.

Bot email: a user wrote that a claimed address is permanent, with one per account, and asked for a way to rename it. BrexitBot suggested plus addresses such as username+botname@mail.grokbot.com, but nobody has confirmed they deliver. (rumor) Test with a message to yourself before you use one on a form. Teams on Google Workspace keep asking for a Google Chat connector. One restaurant group called it "the main thing blocking us."

What to watch: a 0.69 or 0.70 changelog entry, the iOS update with the Copy fix, a setting for the away pause, and any official guidance on paying with a card in chat. The Seattle Grok Bot setup workshop on Monday at 6 PM PT is past capacity, with a waitlist.