Grok Bot's audit log is the chat transcript. Skarn reads it.

Grok Bot is xAI's standing desktop agent, launched in beta on 11 August 2026: each Bot gets its own persistent cloud computer and keeps working after the local device closes. The beta covers SuperGrok, SuperGrok Plus, and SuperGrok Heavy; Cursor Pro, Pro+, and Ultra; and Cursor Teams Standard and Premium. If your organization is on any of those plans, someone on your team is probably already running one.

Why the store matters

Grok Bot's own documentation is explicit: don't paste secrets into ordinary chat. Use the secure secret card instead - the value is masked, excluded from the transcript, and never shown to the model.

The catalog GitHub connector doesn't follow that rule. Setting it up asks for a GitHub personal access token, typed into chat. Official policy says one thing; the connector path does another.

Grok Bot also requires cloud data storage - there's no Legacy Privacy Mode - and named Bots keep conversation and memory across turns. All Bots on one account share one cloud computer: files, browser cookies, CLI credentials. The docs say not to use separate Bots as a security boundary. One paste isn't one chat; it's context every Bot on the account can draw on.

That combination - persistent memory, a shared computer, and a chat window that's also the connector-setup surface - is what makes the local transcript worth auditing on its own, independent of whatever the model does with what's pasted into it.

The team audit view of Bot actions isn't shipped yet. Public write-ups describe it as "coming", and independent reviews note the same gap: no SOC2, ISO, or residency claims in the current docs. Today, the chat transcript is the accountability record.

The incident

On 22 August 2026, in our own Grok Bot session, the catalog GitHub connector asked for a GitHub personal access token and to have it pasted into the chat. Not a dunk on xAI - a case study in a failure mode that's easy to reproduce: the catalog connector wants a PAT, official docs forbid pasting secrets in chat, and a user who follows the connector as designed writes a live token into a durable, shared-computer conversation.

Who else looks

GitGuardian's Developer Endpoint Protection names Cursor, Claude Code, Copilot, Windsurf, and Gemini CLI. Not Grok Bot. Neither agentscrub, Prismor Sweep, nor agentleaks list Grok Bot's session store among their targets. Prismor's Cloak/Sweep hooks Grok Build, the local coding-agent CLI - a different product from Grok Bot, the persistent desktop agent.

If a live token lands in a Grok Bot conversation today, nothing on the incumbent shortlist is documented as reading that store. That's not a criticism of those tools - Grok Bot is 17 days old at the time of writing, and coverage lists take time to catch up to a new product. It's a gap worth knowing about while it exists.

What Skarn does on that store

The scan is local. It reads Grok Bot's on-disk session store the same way it reads ~/.claude/projects/*.jsonl - no upload, no call to xAI's or Cursor's cloud.

skarn assess needs no account and no license. It parses the sessions, detects leaked credentials across 200-plus types, and shows every one masked, never in full. It also correlates multi-stage attack chains - a poisoned context that drives a secret read and then an exfiltration - across MITRE ATLAS tactic-aligned stages, and every finding maps to the OWASP Top 10 for LLM Applications 2025.

Skarn surfaces what it finds. It doesn't rewrite the transcript, rotate a key, or block anything - there's no fix-it bot here, just evidence, attributed to the exact session and message.

One boundary to know before you run skarn setup: the real-time guard does not hook Grok Bot. The app exposes no local hook stream for a pre-execution check to attach to, so skarn guard covers Grok Build and the other CLI hosts, and Grok Bot stays a scan-only source.

What the scan does not see

xAI's approvals, security, and privacy page states that a value entered through the Bot's secure secret request "is masked, excluded from the transcript, and not shown to the model". A secret that goes in through that channel never reaches the local replica, so skarn assess cannot see it and does not need to. A secret typed into the chat as plain text does reach the replica, and that is the case the scan covers. The same page states that "all of your Bots share one cloud computer" and that files, browser sessions, and command-line credentials on it are available across the roster. That computer is xAI's, not yours; nothing on it is on your disk, so it sits outside the scan entirely. Checked 2026-08-28.

If you already pasted a token

Rotate it. Then run skarn assess to confirm nothing else is sitting exposed. Going forward, use the secret card or a GitHub App instead of a personal access token typed into chat.