Claude Duet vs Grok Bot: Who Acts Without Asking?

The interesting question about any agent is not what it can do but what it does before you say yes. Claude Duet is Anthropic's answer to that question, announced on 21 October 2026 and designed around Claude Opus 5.5. Grok Bot is the paid agent product SpaceXAI sells to subscribers, and its public record on the same question reads very differently. Both can sign into your mail, your CRM and your web apps and carry a job through to the end. What separates them in public is not capability. It is which of the two companies wrote down what happens at the moment an agent is about to do something that cannot be undone.

One disclosure first, because it shapes everything that follows. SpaceXAI's own documentation did not load for us: the site returned HTTP 403 to every fetch attempt while this was being written. There is therefore no first-party Grok Bot page to quote the way there is for Duet. Everything in the Grok Bot column below comes from the earlier reporting in this blog's own coverage, which cites its sources, and describes the product as of 21 October 2026. Read that column as a reading of the public record rather than as the vendor's specification, and re-check their pages before you buy anything.

A note on names, once. People type grok bot, grokbot and claude bot as though all three were product names. Only Grok Bot is one; "Claude bot" is a description of an agent built on Claude, not something Anthropic sells. The company behind Grok Bot appears as SpaceXAI in our earlier coverage and as xAI elsewhere in the public record, and both names point to the same company here.

Two records, published very differently

Anthropic published one page on 21 October 2026 and it answers the awkward questions directly. It says what Duet will not do even with your permission. It says who approves an action and when. It says how credentials are held and what was tested before launch. It also volunteers a limitations list, a regional restriction and a waitlist condition — the parts a marketing page usually leaves out. You can disagree with those answers, but you cannot say they were withheld.

Grok Bot's record has the opposite shape: a sequence of dated capability announcements rather than a specification. Per our earlier reporting, an early beta on 11 August 2026 gave each Bot a dedicated cloud computer that signed into Gmail, a CRM and web apps and completed jobs end to end, surfacing only when a decision or an approval was required. Tiers widened on 21 August and again on 26 August; Android arrived on 2 September; shared Team Bots on 28 September; a Primary Bot that spots work and offers to handle it, described by the product's own account on 1 October; native search and monitoring of X on 7 October; a claimable @mail.grokbot.com address from 9 October; and reports, memos and dashboards on 21 October. Each item is a capability. Not one of them is an approval rule.

What it may do without asking

Duet reads, drafts and prepares work on its own. Before it sends a message, makes a payment, signs a document or deletes anything, it shows you exactly what it is about to do and waits for your approval. Notice where the line sits: it is drawn around the class of action, not around how the task started. A scheduled job and a request you typed out loud hit the same gate. That is the cleaner design of the two, and it is also the one published in a form you can check in advance.

Grok Bot's published line, per our earlier reporting, is about the return trip rather than the action. The Bot works inside its own cloud computer and comes back to you when a decision or an approval is needed. That sentence is doing real work — it tells you a checkpoint exists — but it does not tell you which decisions qualify or which approvals are required. The record our reporting assembled contains no list of unsupervised actions, and it contains no statement of whether a scheduled routine and a one-off request are treated the same way.

The fair summary is that Duet's rule is narrower and documented, while Grok Bot's rule is broader and undocumented. That is not a claim that one product is safer. It is a claim about what a buyer can verify, and only one of the two is verifiable from the outside today.

What it refuses even when you ask

Anthropic named a floor. A few things are off limits even with your approval, including trading securities and moving money between accounts — not prompts you can click through, but out of scope. On top of that sits a dedicated classifier and safety system prompt that checks each message for sensitive-information leaks, rejecting requests to share credit card numbers and government identification and letting health or personal-finance detail through only when the agent has been explicitly told to send it. Red teams and an external firm penetration tested the product, and it is covered by a public bug bounty.

Grok Bot's record offers no equivalent floor. The sharpest illustration is the 9 October email address: per our earlier reporting, a Bot can claim an address ending @mail.grokbot.com and use it to sign up for services, contact businesses on your behalf, or schedule time with someone. Whatever the intent, that capability sits close to the account-creation and identity territory Anthropic explicitly fenced off. Our earlier reporting found no published statement of what Grok Bot declines when asked directly, and no description of a content classifier standing between the agent and the outside world. The absence is not evidence of bad behaviour. It is absence of evidence, which for a purchase decision is its own kind of answer.

Whether it ever sees your password

Duet's credential handling follows the design Anthropic uses for Claude Managed Agents, so the agent never directly sees your passwords or sign-in tokens. That is a structural answer rather than a policy promise: the model is not handed the secret in the first place, which means a persuasive instruction injected into a web page has nothing to extract. The outbound classifier described above is a second layer aimed at what the model tries to emit.

Grok Bot's architecture, as described in our earlier coverage, makes the credential question load-bearing in a way that is worth stating plainly. A dedicated cloud computer that signs into Gmail and a CRM is, functionally, signed in as you. That is precisely the design that makes end-to-end completion possible, and it is precisely the design that puts every downstream session inside a machine the agent controls. Our reporting did not establish how those credentials are stored, whether the model can read them, or whether a second classifier inspects what leaves. Those are the questions to put to the vendor, and the one honest thing a comparison can say is that they have not yet been answered in public.

What disconnecting actually deletes

Anthropic says you are able to disconnect any app Claude Duet has access to. It does not say what happens to what Duet already learned from that app, and it describes no reset operation covering memory and scheduled tasks. That is a gap in the documentation rather than evidence of worse behaviour, but it is a gap, and the honest reading is that Duet's retention semantics are unpublished. For anything touching client records, that question belongs before you connect the account rather than after.

Grok Bot's retention question is harder to answer, because the product accumulates more of you. Per our earlier reporting, a Bot builds a history of completed jobs, may share state with colleagues through Team Bots since 28 September, and may hold an email address that is itself the recovery route for accounts it created on your behalf. In a system like that, removing a connector is not obviously the same act as removing what the Bot knows. Our reporting found no published deletion semantics at all. If you are considering one of these for a shared inbox or a client-facing workflow, this is the single question most likely to matter in a year and least likely to be answered on a launch page.

What a background check costs in plan limits

Duet is included in Pro and Max during the research preview and shares your plan's usage limits with the rest of Claude. It spends them differently: background checks count toward those limits, and larger tasks such as building a financial model require more model turns and more background work. Anthropic explains the every-few-hours cadence as a cost control — checking nonstop would use up the plan's limits much faster — which is a useful admission disguised as a footnote.

Grok Bot is sold as subscription access rather than metered agent time. Per our earlier reporting, the meter that does exist is weekly included usage, and it measures the account rather than the Bot. That is a defensible commercial design, and an unhelpful one for budgeting: you cannot price a repeated background check when the thing being counted is not the check. The October consolidation that folded the Bot into a single subscription with the rest of the vendor's products made the packaging simpler without making the unit economics any more legible.

Five questions, one card

Set the two records side by side and the asymmetry becomes easy to hold. Only one vendor has published answers to the questions that decide whether an agent belongs inside your accounts. The card below is the article compressed to the five things worth asking, and it is worth carrying into a trial rather than reading once.

The engine question, and the one statement that crosses

There is one point where the two records touch, and it is not a safety question. On 7 October 2026, per our earlier reporting, Elon Musk said on X that the company would use the best back-end model for any given task, naming Claude Opus 5.5, MidJourney, Suno and other leading APIs, on the reasoning that the Bot should reach for whatever is most likely to produce the best outcome. The statement was picked up within two days by The Information, Gizmodo, 9to5Mac, Android Headlines, TechRepublic and music trade press. It remains a statement: no rate card, no changelog entry, no shipped artefact and no outside measurement of it exists in the record.

Take it seriously anyway, because of what it implies about the two products. Duet is designed around Claude Opus 5.5 and cannot be pointed at another vendor's model. Grok Bot, if that October claim becomes shipped behaviour, is explicitly designed to route each task to whichever model wins it — and on the record we have, Claude Opus 5.5 is named as one of the destinations. One is a fixed engine inside an app. The other is an app that may treat the engine as a commodity.

That distinction has a practical edge for anyone building rather than buying. Claude Opus 5.5 is available on OrcaRouter at $4.00 per million input tokens and $20.00 per million output tokens, with a 1M-token context window and cache reads at $0.20 per million, through one OpenAI-compatible key that reaches more than 200 models, with no markup over provider list price and automatic failover across providers. To be exact about what that is not: OrcaRouter does not host Claude Duet or Grok Bot, and neither product can be run through our API. What you can do is put the same model behind a loop you write and keep it running when a consumer plan would have stopped it.

What to ask before you connect an account

The two products are not equivalent purchases, and the difference is not the model behind them. Duet's record is a specification: five questions asked and answered, with the gaps — retention and price per completed task — named as gaps rather than filled with confident prose. Grok Bot's record is a capability timeline: what it can reach, when that reach expanded, and who could buy it. Timelines tell you a product is moving. They do not tell you where it stops.

That asymmetry should shape how you evaluate them rather than which one you pick. With Duet, you can read the refusals, find one you disagree with, and decide whether you can live with it before spending a week. With Grok Bot, you are buying on the strength of a demonstration and a set of announcements, and the approval semantics, credential handling and deletion rules remain open questions that a trial will not necessarily answer, because a trial shows you what the agent did, not what it was permitted to do.

So ask. Find the sentence that says what the agent may do without asking, and check whether it covers scheduled work as well as research. Find the list of refusals and see whether it is a list of things the product will not do or a list of things you can override. Find out whether the model ever holds your credentials or whether a separate layer does. Find the deletion rule, and notice whether disconnecting removes what was already learned. Find out whether background checks spend your plan and at what rate. One vendor answered all five in writing on the day it launched. The other has not yet, and that is the most useful fact in this comparison.