On August 26, 2026, xAI made Grok Bot available as part of every SuperGrok and Cursor Pro subscription. Weekly usage limits were reset at the same time. Cursor CEO Michael Truell, whose team built the product, said of it: “It’s grown faster than any product we’ve seen.” Elon Musk amplified the news with a line that tells you how confident xAI is in the thing: “Try it out. If Grok Bot messes up, we will make you whole.”
If you missed the original launch, Grok Bot arrived on August 11, 2026 — always-on AI agents that run on their own cloud computers rather than inside a chat window on your laptop. There are desktop apps for macOS, Windows and Linux. The agents keep working when you close the lid.
Two weeks later it’s bundled into two of the most widely held subscriptions in the AI tooling world. That second event matters more than the first, and most of the commentary has the emphasis backwards.
“Included” changes the population, not the product
A launch tells you a capability exists. A bundling tells you who has it.
Before August 26, having an always-on agent meant a deliberate decision: evaluating a new product, adding a line item, convincing someone it was worth it. That filter selects for early adopters — people who were going to figure this out anyway.
After August 26, a large number of people who never made that decision woke up with an always-on agent in their account. Developers with Cursor Pro. Founders and operators with SuperGrok. Some of them run sales, and many have never thought seriously about agentic outbound. Now the tool is simply there, already paid for, weekly limits freshly reset.
To be precise, since the internet is already getting this wrong: Grok Bot is not free. It is included with paid SuperGrok and Cursor Pro subscriptions. That distinction tells you the shape of the population that just got access — people already paying for serious AI tooling, not the entire internet. Still a large, well-resourced group now holding a capability they did not shop for. Capability arriving ahead of intent is exactly when interesting and stupid things both happen fast.
What an agent is genuinely good at in outbound
Let’s separate the real from the pitch deck. Here is where an always-on agent earns its keep in a sales motion today.
Research that nobody was ever going to do
Every outbound team has a research standard they wrote down and then quietly abandoned by week three, because reading forty company blogs a day is not a job a human sustains. An agent running on its own machine does not get bored on account nineteen. This is the single highest-value use and it is available right now.
Qualification and scoring against your actual criteria
Not a generic fit score — your criteria, described in plain language, applied consistently to every record. Consistency is the win, not intelligence. A human scorer drifts across a list of 500; an agent applies the same rubric to record 500 that it applied to record 1.
Drafting
Agents write competent first drafts of sequences and one-to-one messages. Competent, not great. Treat the output as a starting position you edit, and the leverage is real. Treat it as final copy and you will ship the same mush as everyone else who did that.
Monitoring and reporting
Watching for triggers, flagging reply patterns, noticing a segment quietly dying, assembling the Monday number so a human doesn’t spend an hour in a spreadsheet. Always-on is the whole point here: this is work that only has value if it happens continuously.
What an agent must never own: the send
Here is the line, and it is not a soft one.
An agent can decide what to say and to whom. An agent must never be the thing that pushes bytes out of your sending domain.
Cold email, LinkedIn and Instagram outreach all live or die on pacing: volume ramps that build slowly, daily and hourly caps per account, gaps between actions that look like a person rather than a script, warmup that establishes reputation before you touch a real prospect. That is the difference between an account that works for years and one restricted in a week.
An agent optimizes for the task you gave it. Nothing in that objective protects your domain reputation or your LinkedIn account, and a burned sending domain is far more expensive than a slow week.
Give an agent direct sending credentials and a target list and it will do exactly what you asked, at a rate that gets your domain flagged. Not because it is reckless — because “send these 400 emails” contains no instruction about pacing.
The right architecture is boring and it is correct: the agent proposes, a purpose-built scheduler disposes. The agent writes the campaign. Something else — something whose entire job is safety and pacing — decides when each individual message actually leaves.
The plugin marketplace has a hole in it
Grok Bot ships with an in-app plugin marketplace at Settings → Plugins, currently 219 plugins. The featured sales stack is a strong lineup: Apollo, Clay, Gong and HubSpot.
Look at what that stack actually does end to end:
| Stage | Covered? |
|---|---|
| Find and enrich prospects | Yes |
| Score and segment | Yes |
| Analyze calls and conversations | Yes |
| Log everything to the CRM | Yes |
| Actually send and pace cold outreach | No |
The featured sales stack can enrich, score and log — and contains no cold-email sending layer at all. You can research a prospect perfectly, qualify them precisely, draft a beautiful sequence, and then arrive at a dead end where a human has to go paste it somewhere.
This is not an oversight. Sending is a genuinely dangerous surface — reputation, warmup, per-account caps, provider-specific limits — and it’s reasonable that a general-purpose agent platform doesn’t try to own it. But anyone building an agentic outbound motion on Grok Bot today has a gap between “the agent decided” and “the message went out.”
Wiring in the missing layer via MCP
The gap is filled with MCP — the open protocol agents use to talk to external tools. Any platform that exposes an MCP endpoint can be added as a custom connector, sitting alongside the marketplace plugins and callable in plain language.
For outreach specifically, this is where a platform like WarmySender slots in. It is built agentic-first — the whole premise is running outreach on autopilot with AI agents — and it covers five channels: cold email, email warmup, LinkedIn, Instagram and multichannel, plus real-time email verification. Grok Bot can drive it, and so can Claude, ChatGPT, Cursor, Codex, OpenClaw, Hermes Agent, or any agent that speaks MCP.
What an agent can actually do through that connection, in plain language:
- Create, launch, pause, resume and manage campaigns across cold email, LinkedIn and Instagram
- Create and enroll prospects
- Verify emails in real time before anything gets sent to them
- Configure warmup and read back stats
And — this is the part that makes it safe to hand to an always-on agent — what it categorically cannot do:
- The agent never sends a message, DM or invite directly. Creating or launching a campaign only writes it and hands it to the scheduler.
- The agent can never raise a limit. Not by asking, not by insisting, not by being clever about it.
- Connecting and disconnecting accounts stays in the app. It is deliberately not an agent tool.
The scheduler paces every email, LinkedIn action and Instagram action within safe caps and a gradual ramp — regardless of whether a human or an agent triggered it. That last clause is the entire design. Safety isn’t a rule the agent is asked to follow; it’s a property of the layer underneath, which means it holds even when the agent gets an ambitious instruction at 3am with nobody watching.
Connecting is straightforward: point the agent at https://warmysender.com/mcp with a ws_ API key. There’s a Grok Bot–specific walkthrough at warmysender.com/documentation/connect-warmysender-to-grok-bot.
Safe operating rules for agentic outbound
If you’re wiring this up in the next week — and given the bundling, a lot of people are — these are the rules worth adopting before you have an incident that teaches them to you.
1. Never hand an agent raw sending credentials
No SMTP passwords, no session cookies for social accounts. Route every outbound action through a layer that enforces pacing independently of what the agent asks for. If your architecture depends on the agent choosing to behave, your architecture is wrong.
2. Verify before you enroll, not after you bounce
Agents assemble lists fast, and a fast list is a dirty list. Real-time verification in the pipeline is what stops speed from turning into a bounce rate that damages your domain.
3. Keep warmup running while volume climbs
The temptation with an agent is to scale immediately because the marginal cost of another 500 prospects is nearly zero. Sending capacity does not follow research capacity. Warmup and ramp schedules exist precisely to keep those two curves separate.
4. Review the first send of every new sequence
Not every send — the first one. Agent-drafted copy fails in specific, spottable ways: a merge field that reads wrong, a claim about the prospect that’s subtly false, a tone that’s off for the segment. One human read catches nearly all of it and costs you two minutes.
5. Make the agent report, and actually read it
An always-on agent that nobody checks is an unsupervised system, not an automated one. A daily digest of what it did, what it queued and what it flagged is the minimum. If you can’t answer “what did it do yesterday” in under a minute, you don’t have a workflow — you have exposure.
6. Decide what needs a human, in advance
Write down which actions require approval before you build anything: campaigns above a size threshold, anything touching existing customers, anything in a regulated segment. Deciding this afterward is how policies get written in a bad mood.
The honest read
Bundling Grok Bot into SuperGrok and Cursor Pro is a genuine step change in how many people have an always-on agent. It is not a step change in what those agents should be allowed to do unsupervised, and the people who conflate the two will spend the autumn rebuilding sending domains.
The useful version of this is unglamorous. Let the agent research at a volume no human sustains, qualify consistently, draft copy you then edit, and watch and report while you sleep. Then hand the actual sending to a layer built to protect the accounts.
The agent should be the smartest thing in your outbound stack. It should never be the fastest.
If you’re connecting Grok Bot to an outreach stack this week, the missing sending layer is the piece to get right first — WarmySender speaks MCP and does the pacing for you.