Can Grok Bot buy things for you? How payments work, one-time cards, failed orders, and who's liable (unofficial guide)

The short answer

Your Bot can shop, build a cart, and pay. It never sees a saved card number or security code; Vault and Secure Forms fill those into the page without showing them to the model.

If you want to approve every payment, don't save a card in Vault. Enter it in a Secure Form at checkout with Securely save to Bot's vault unchecked, or use a one-time card, and add an Ask first rule for purchases.

When something goes wrong, have the Bot check the order status before it tries again, so a slow checkout doesn't turn into a double charge.

This guide is independent and unofficial. It isn't affiliated with or endorsed by xAI, Grok, or Cursor. Payment features change often, so check the linked changelog and help pages.

Ways your Bot can pay

A card saved in Vault (Settings → Vault, Grok Bot 0.75.2 or later). The card fills in at checkout, and your contact info fills shipping and billing.

A card you enter for one chat. When the Bot asks with a Secure Form, leave Securely save to Bot's vault unchecked and the card is used only in that chat, then expires. The changelog also says Bots can use card details or a photo you send in chat, but a Secure Form keeps the number out of the transcript.

Shop Pay, through Shop checkout where a store accepts it and with a one-time Shop card elsewhere. Since v0.78.1 you can connect it in the Vault's Payments tab.

Stripe Link and X Money, added in v0.70.2. Per v0.77.0, the Bot offers Link one-time cards only in the US and Canada.

A store's own connector. Orders placed through a store's connector pay with that connector's own options.

The Bot pays in a set order instead of asking which wallet to use, and it tries saved Vault cards before another way to pay. In the Vault's Payments tab you can pick the method Bots use first.

Will it ask before it buys?

The changelog says yes: v0.77.0 says "you still approve every purchase", and v0.78.1 says Buy now "starts an order you approve". The Order Concierge and Deal Watcher templates are described as never buying without your OK.

Cursor's help page and the security docs are more cautious. They say a card saved in Vault fills in at checkout without a separate approval each time, and that there's no setting that forces approval each time a saved card is used.

Until those match, follow the stricter one. Don't save a card you wouldn't want used without asking, and set your own boundaries in two places.

In the request: say "Build the cart and stop before paying. Show me the store, items, total with tax and shipping, delivery date, and return policy."

In Settings → Permissions: add a rule under Always Ask for purchases and payments. An action that matches an Ask first rule always gets an approval card.

Approval cards from routines and other background work expire after 30 minutes. A purchase you didn't approve in time simply doesn't happen, and the Bot says so.

Steps you still do yourself

Bank card verification, payment confirmations on another device, passkeys, and CAPTCHAs are hand-off steps. Choose Take over on the request, complete the step, choose I'm done, and tell the Bot to continue.

Never send a password, one-time code, or card security code in ordinary chat. Use the Secure Form when the Bot asks.

Some stores block AI agents. In October 2026 users reported Amazon blocking Bots, and Elon Musk suggested asking the Bot to buy somewhere else. Don't ask your Bot to get around a store's block.

When an order goes wrong

A checkout that hangs or times out hasn't necessarily failed. Before any retry, have the Bot check your email, the store's order page, or your card activity for the order. This "check before you redo" rule is the most common advice in agent-payment threads on Reddit.

After you place an order, v0.78.1 says the Bot tracks it and tells you when it ships or arrives. Ask it to keep the order number, total, and store in a note so you have a record.

For a wrong item, a return, or a refund, the Bot can draft the request and you approve it before it goes out. Per v0.77.0, when you ask what happens if an order goes wrong, the Bot cites only protections it has actually read and doesn't promise refunds.

If a charge looks wrong, contact your card issuer or the store yourself. Remove the card in Settings → Vault if you want to stop the Bot paying with it.

Who's liable if your Bot makes a mistake?

On Oct 15, 2026, Elon Musk posted on X: "If Grok @Bot makes a mistake with a purchase or leaks your card (never happened yet), SpaceX will make you whole."

That's a post, not a written policy. We haven't found purchase-protection terms in the Grok Bot docs. Read the current terms before you rely on it, and keep your normal protections in place: your card issuer's dispute process and the store's return policy.

The simplest protection is the card itself. A one-time card, or a virtual or low-limit card from your bank, caps what a mistake can cost. We didn't find a setting that caps how much a Bot spends on purchases; the spend limit in Usage & Billing is for Grok Bot usage, not store orders.