xAI has added dedicated email addresses to Grok Bots, giving each bot a persistent inbox for receiving messages. According to xAI’s Grok Bot changelog, a bot can draft an outgoing email but can’t send it until a user approves the draft card.
That makes this a constrained email capability, not autonomous delivery. A bot can receive mail and prepare a response, but the final outbound action stays with a person. The approval step matters because sending is often the irreversible part of an email workflow, and it can stop a bot from dispatching a mistaken or inappropriate reply on its own. xAI’s description doesn’t say what the approval card shows, whether users can inspect recipient fields and attachments separately, or how edits to a draft are handled before sending.
An inbox is a new kind of agent surface. A dedicated address gives a bot a standing presence in email, instead of limiting it to material pasted into a chat. The changelog doesn’t describe how incoming messages are filtered, whether attachments are available to bots, or what permissions apply when several people share access to one bot. That doesn’t mean the feature is unsafe, but it leaves open how the bot tells an email’s content apart from instructions it should follow. Email mixes private correspondence, messages from unknown senders, forwarding chains, and ambiguous requests, so an inbox puts sensitive data and untrusted input in the same workflow. The public description doesn’t say whether a bot reading an email could be induced to reveal information from other messages, reach connected services, or change a draft’s recipients.
A separate incident shows what a wrong destination costs. Business Insider reported that XMTP Labs CEO Shane Mac said his Grok Bot financial agent posted personal account balances and an expense audit to a company Slack channel after confusing similarly named destinations. That’s a different workflow, and it doesn’t show the email feature behaves the same way. xAI says email sending requires approval. But it illustrates why the question isn’t only whether a draft needs confirmation. It’s also what the user is being asked to confirm, whether recipients, copied recipients, attachments, or quoted text. xAI hasn’t published what its approval interface highlights.
Catching phishing isn’t the same as securing an inbox. Cybernews reported that a Grok Bot spotted a phishing message that had passed standard email checks, and warned that shared bot access and prompt injection could create cross-agent exposure risks. That suggests bots could be a useful extra layer for inspecting suspicious mail. It doesn’t establish that the new feature is protected against prompt injection, or that it has been tested against attacks delivered through incoming email. A bot can flag one malicious message correctly and still face hard questions about which messages it should read, summarize, quote, or act on, and neither the changelog nor the Cybernews report answers them.
Bottom line: xAI has introduced email-enabled Grok Bots with a human approval step for outgoing messages. The send control is a useful limit. Whether it’s a sufficient one depends on safeguards xAI hasn’t described: how incoming content is treated, how attachments and shared access work, how recipients are chosen, and what the approval card actually shows.
Internal link idea: connect this to your Grok Bot card-photo and Stripe checkout pieces. All three show the same pattern of expanding agent abilities with a human approval step, and each leaves the details of that step undocumented.
