xAI has released a business version of Grok Bot: agents that sign into a company's own software with a login of their own and finish the work inside it, without a person approving each step. The first two weeks are free, an offer aimed at the customers of Cursor, the coding company SpaceX bought for $60 billion. xAI belongs to SpaceX too, after two mergers this year.
In finance, recruiting and sales, working inside the system means the agent updates the record rather than producing a draft for somebody else to type in. Two free weeks needs no purchase order, and connecting an agent needs a login, which a department head can hand over without involving the technology team.
A member of staff signs in with a password and a code, and signs out again. An agent is connected once and keeps that access until somebody removes it.
In August 2025, attackers stole the tokens belonging to Drift, an AI chat agent that Salesloft sold for handling sales conversations on company websites, and used them to pull data out of hundreds of Salesforce systems over about ten days. Google's Threat Intelligence Group and Palo Alto Networks' Unit 42 later found the same tokens had reached Slack and Google Workspace accounts Drift was connected to. Salesforce itself was never broken into.
The attackers never needed a password from any of those companies. The tokens let them present themselves as Drift, an application those systems trusted, and a connected application can query whatever the permissions granted at setup allow, as the security firm Anomali described it. FINRA's alert to member firms listed what came out alongside the contact records: API keys, cloud credentials and passwords staff had typed into support tickets.