Grok Bot vs Pally (2026)

Plugins connect Gmail, Notion, Slack and other services under the account used to sign in, added from Connect apps in the desktop sidebar, the mobile app or an in chat card. Beyond plugins, a Bot logs in once to tools such as Zendesk on its own computer and works inside them the way a person would, including tools that are hard to navigate. Bots can also claim their own address on mail.grokbot.com to receive, search and send email.

Sourcecursor.com/help/grok-bot/connect-pluginsread 2026-10-12

Pally connects to Gmail, Outlook and iCloud mail, Google and iCloud calendars, WhatsApp through Linked Devices, iMessage through its Mac app, Slack, Google Drive, Docs and Sheets, Notion, Linear, GitHub, Jira, Todoist, Granola and X, with app authorization handled by Composio and room for custom integrations.

It acts in them, sending WhatsApp and iMessage messages and email, forwarding mail, creating calendar invites and editing a Google Doc in place once the user approves. Sites without an integration are reached through browser errands that sign in with saved logins, and a bank account can be linked read only for recurring charges.

Sourcepally.com/airead 2026-10-12

A user creates several Bots, one per project or function, and gathers them in a group chat, where they answer in the thread, take requests addressed to one Bot with an @mention, and message each other directly to hand off work. Bots carry a project from start to end, launch subagents and cloud agents, and run routines a user can teach by doing a workflow once while a Bot follows along. Because all of a user's Bots share one computer, files, browser and logins, a handoff keeps its context.

Sourcex.ai/botread 2026-10-12

Background tasks carry an errand across messages, email, the browser and calls, retry after a brief model error and pick up new choices from the chat while they run. Automations are written in a sentence and can carry conditions, such as nudging a friend who still owes money once three days pass. Through the trusted network, a user's Pally hands parts of a job to the Pallys of a partner, friends or colleagues, each acting under its own owner's sharing choices, and in a group chat each member's request runs on that member's own Pally and accounts.

Sourcepally.com/trusted-networkread 2026-10-12

A routine tells a Bot when to run a workflow, either on a schedule or when something happens, such as a Slack message, a GitHub, Linear, Sentry or PagerDuty event, an email or a webhook call. Routines run in the cloud while the user's laptop is closed and can be paused or resumed from the Bot's details. Users also message Bots from macOS, Windows and the iOS app, talk to them by voice, and email them at their own address.

Sourcecursor.com/help/grok-bot/routinesread 2026-10-12

Automations fire the moment something happens, such as an email from a landlord, or on a schedule, and email triggered rules read new Outlook and Gmail messages as they arrive. Morning briefs, alerts on important messages across every connected account, flight day changes and price drop or restock watches arrive unprompted. People reach Pally by text, voice note or a call to its number, and in an iMessage or Telegram group it answers when someone names it or replies to one of its messages.

Sourcepally.com/airead 2026-10-12

Bots work from the files on their shared computer, the services connected through plugins and the tools they sign in to, reading what each task needs as it runs, and a Team Bot can carry a description and secrets its owner sets up for the whole team. There is no curated knowledge base or search index that a team maintains for its Bots.

Sourcex.ai/botread 2026-10-12

Connected mail, calendars, chats, Drive files and Notion pages are read when a question needs them, and web research runs through Exa. From each connected inbox Pally also keeps structured records of receipts, order confirmations and renewal notices from about the past 12 months, with merchant, items, amount, date and repeat cycle, alongside recurring charges from a linked bank account. Outside those purchase records, documents are read at request time instead of being indexed into a lasting knowledge store.

Sourcepally.com/privacyread 2026-10-12

Each Bot keeps context on how its user works and updates its own memory as it learns, such as noting that a customer only signs annual contracts and who approves them, and a user can make a standing rule by asking a Bot to remember it. Bots also learn from one another, and the shared computer keeps files, browser state and logins between runs while chats are stored separately. A user gets no retention period for a Bot's memory and no way to review or remove a single entry.

Sourcex.ai/botread 2026-10-12

Memory is built around people, not files, covering who the user talks to, what they last discussed and what was promised, such as a friend's dietary needs or a deck owed to an investor. Pally tidies it every night, and the user can ask what it remembers, edit it, tell it to forget something, which then stays out after the nightly update, download it or delete the account. Memory is held per user, a group chat's history and memory belong to the group, and both are kept while the account is active.

Sourcepally.com/privacyread 2026-10-12

When an action needs approval, the conversation shows the proposed operation and its inputs, and the user picks allow once, always allow, which can save a matching rule, or deny, with the same controls on iPhone.

Auto Review, an independent review model, checks risky actions before they run, covering shell commands, plugin calls, computer use, changes to routines and triggers, and subagent launches, and it lets them proceed, holds them for approval or stops them.

Members can add their own check first rules, and Enterprise admins can enforce Auto Review with team rules members cannot switch off.

Sourcecursor.com/docs/grok-bot/securityread 2026-10-12

Pally checks with the user before it spends or sends anything not already asked for or approved, and sends on its own only within limits the user sets, such as messages to a named group. A purchase lays out the exact items, seats, fees and total for a single approval, stops if any of them change, and follows the wallet's own approval settings.

Drafts appear before they go and expire after seven days unapproved, approvals can be given by voice during a call, approvals in group chats happen privately in each person's own thread, and the user can take over a live browser session and hand it back.

Sourcepally.com/airead 2026-10-12

Grok Bot uses Cursor's sign in, auth and Privacy Mode, with SAML or OIDC single sign on on Teams Premium, and SCIM, the MCP allowlist and organization computer management on Enterprise. Admins control network destinations, team secrets, setup scripts, sudo on Bot computers and action recording, and API keys go into masked secret cards that keep the value out of chat and files. Anysphere, the company behind Cursor, holds ISO 27001 and ISO 42001 certification from Schellman with Grok Bot in the current scope, and data is deleted or returned within 30 days of written direction under the DPA.

Sourcecursor.com/docs/grok-bot/securityread 2026-10-12

Each person in the trusted network picks, one capability at a time, what their Pally may share with each circle, starting from just a name and contact card, and in a group chat a personal request never runs on another member's accounts. Data is encrypted in transit and at rest with access limited inside the company, website logins sit in an encrypted vault run by Kernel that Pally itself never sees, and content arriving from outside is treated as information, never as instructions. Pally holds no SOC 2 or ISO certification and offers no team administration or single sign on.

Sourcepally.com/trusted-networkread 2026-10-12

Enterprise teams get audit logs and OpenTelemetry export of Bot activity, and admins can switch on action recording for team computers. In every plan, the conversation shows each operation awaiting approval with its inputs, and Teams plans add shared usage analytics. Usage and spending views count Bot work as Grok Bot usage, without naming the model behind each request.

Sourcecursor.com/docs/grok-bot/securityread 2026-10-12

Browser errands run with a live view and screenshots the user can watch, paused while a card number is entered, and a stopped session comes back with an accurate account of what happened. Users can ask what changed in their automations, rules and saved preferences, group automations show their latest real results, and recalled activity appears in the user's own time zone. A log of every step and tool call behind a task, ready for export or review, is not part of the product.

Sourcepally.com/changelog.mdread 2026-10-12

Each member gets one hosted microVM in the US, reached through Cursor's servers, with internet traffic leaving through static egress addresses shared across customers. Enterprise teams can route a computer's traffic through a member's desktop, install their own networking client or set proxies and TLS inspection, which connects the cloud computer to private networks without moving it. There is no region choice or deployment inside a customer's own environment.

Sourcecursor.com/docs/grok-bot/securityread 2026-10-12

Everything runs on AWS in the US, with iMessage, RCS, phone and email delivery through US providers and Telegram traffic passing through the UAE. Cloud Mac instances are dedicated macOS machines on AWS in the US. A user cannot choose a region, and there is no private deployment or self hosting.

Sourcepally.com/subprocessorsread 2026-10-12

A marketplace offers ready made Bots, each built for one role, among them Sales Outbound, Talent Scout, Paid Media, Expense Manager, Product Performance, Bug Reproduction, Account Health and Chief of Staff. Sales Outbound, for one, researches accounts overnight, ranks contacts by intent and drafts email and LinkedIn messages in the user's voice for review. A Bot's identity, skills and routines can be shared as a public link for others to copy, owners can publish a Team Bot that every teammate chats with privately, and Teams plans add a team marketplace for skills and plugins.

Sourcex.ai/botread 2026-10-12

Ready made recipes start from one message and each does a whole job. They include Inbox triaged, Morning brief, The friendly nag, WhatsApp and iMessage catch up, Flight finder, Flight day, Price drop and restock watch, Buy it for me, Pre meeting briefs, A memory for your people, Receipt keeper, Your Mac from anywhere, Call Pally and Quote hunter. A machine readable catalog lists every guide and recipe entry point with its opening message.

Sourcepally.com/airead 2026-10-12

For each task, Grok Bot picks the model most likely to do it well, an xAI model or a third party model from a provider on the subprocessor list, and the choice can change from one request to the next. Users cannot see, choose or block a model, there is no model picker, and a team's Cursor model allowlist does not apply to Grok Bot.

Sourcecursor.com/help/grok-bot/modelsread 2026-10-12

Pally picks the model for each turn. Most turns route through OpenRouter to hosts that do not train on user data, running Google Gemini, OpenAI and Anthropic Claude models, with open weight models served by Phala, Novita, Together AI, Modal and Baseten for some steps, and OpenAI also handles phone calls, transcription and memory search. A user cannot choose the model, and routines that pass the usage limit keep running on a lighter one.

Sourcepally.com/subprocessorsread 2026-10-12

Outside systems reach a Bot through a routine started by a webhook call, with the routine's own URL and key shown on its details. That is the one inbound path. There is no public API or SDK for creating Bots, sending them work or reading their results, and MCP plugins point outward to other services.

Sourcecursor.com/help/grok-bot/routinesread 2026-10-12

Pally runs its own MCP server over streamable HTTP, secured with OAuth 2.1, dynamic client registration and PKCE, and it connects from Claude, ChatGPT in developer mode and Cursor once the user sends a single use code in the Pally chat. It exposes two tools, message_pally to send a message and get the reply and check_pally to collect the result of a long job, under the same approval rules as the chat. There is no public API or SDK for managing tasks, automations, memory or connections directly.

Sourcepally.com/mcpread 2026-10-12

Auto Review judges each risky action as it happens, a guardrail on behavior, and a taught routine is saved from a single demonstration. Neither tests a Bot's output. There are no test cases, quality checks or comparisons of a Bot's results before or after a change.

Sourcecursor.com/docs/grok-bot/securityread 2026-10-12

An automation starts work as soon as it is written, with no test run, quality check or side by side comparison beforehand. Pally reports changes to a user's setup once and explains them on request, which keeps configuration visible without measuring how well the assistant performed.

Sourcepally.com/changelog.mdread 2026-10-12

Bots share a persistent cloud computer with files, a browser, installed apps and saved logins, sign in to a team's apps and websites and use them the way a person does, including tools that are hard to navigate. When a site blocks cloud traffic, the Bot hands the step to the user or routes its traffic through the user's desktop, and with permission it can run commands on that desktop, asking before each one by default. Settings can update, recover or reset the cloud computer, keeping saved Bots, files and logins.

Sourcex.ai/botread 2026-10-12

Browser errands run in a hosted browser on Kernel that signs in with saved logins or Google, reads one time codes from email or messages, fills checkout forms, takes seat holds and completes orders on sites such as Amazon and Instacart, stopping to tell the user what a site needs when it gets stuck. The user can watch the live view, take control and hand the session back. The Pally Mac app lets Pally see the user's own Mac screen, find a file and run the next step, and Cloud Mac, sold separately, gives it a dedicated macOS machine in the cloud.

Sourcepally.com/airead 2026-10-12