Grok Bot Vault: Save Your Logins, Not Your Card

0:00Your Grok bot can now keep your passwords, your addresses, and your credit card. It signs in for you. It checks out for you. And honestly, that's really useful. But there's one thing about saved cards that the help page says plainly, and most people are going to miss it. So let's set up the vault the safe way. What to save, what to skip, and the one setting worth adding

0:22today. This one straight from the Grok bot change log, October 23rd. Bots can save your logins, cards, and contact info to a vault in settings, and fill them in to sign in or check out. You'll need Grok bot 0.75.2 or later. A vault holds three kinds of things: logins, a website, a username, and a password. Cards, the number, expiry, security code, name, and billing address. And contact info, names,

0:53addresses, phone numbers, and emails. So how does it keep a secret secret? Your bot never sees a saved password, a card number, or a security code. The vault fills those in for it. What the bot can see is your contact info, and a list of which logins you've saved. Keep that split in mind. It matters later. Let's set it up. First, update the app and check that you're on 0.75.2 or later. Then open settings and go to vault. It's there on your computer and on your phone. Choose new item, then pick login, card, or contact info. For a login, add the website, your username or

1:36email, and the password. Then save it. Every item can have a hint telling the bot when to use it. Something like, "Use for work purchases." You can also save things in the middle of a chat. When the bot needs a detail, it may show you a secure form. If that form has a box that says, "Securely save to bot's vault, you

1:57decide." Ticked, it goes into the vault. Unticked, it's used for that chat only, and then it expires. One catch, a form without that checkbox saves straight to the vault. Already have a pile of passwords? On a computer, you can import a CSV export from 1Password, Chrome, Edge, Safari, Firefox, Bitwarden, or LastPass. The file is read on your machine, and it's never uploaded. But, that export

2:26holds every password in plain text. Delete it the moment the import finishes, and empty the trash, too. From then on, when a site wants you to sign in, the bot tries your vault first, then a connected password manager like 1Password, and only then asks you with a secure form. And if it signs up for a new site, and you let it pick the password, the vault makes one up and saves it. The bot never sees that one,

2:53either. So, the good stuff. One, your passwords and card numbers stay out of chat, which is exactly where the docs say they never belong. Two, the bot can sign in and check out on its own without handing you the computer at every login. Three, new passwords it creates are made by the vault, and the bot never sees them. Four, hints let you steer which card or address it picks. And five, moving in is easy. One import from your password

3:24manager, read right on your own machine. Now, the part that actually matters. Number one, and it's the big one, a saved card can be used without asking you. Grock bot's help page says it directly. There's no setting that requires your approval each time a saved card is used. So, a saved card isn't a payment you approve. It's a standing permission. If you want to okay every payment yourself, the help page's own

3:52answer is simple. Don't save the card. Number two, the vault covers your whole account. Every item is available to every bot, and you can't lock an item to just one of them. So, your research bot can use the same card as your shopping bot. And the docs are clear. Separate bots are not a security boundary. Number three, your contact info is visible to the bot. And when you mention your name, address, phone, or email in a chat, it gets saved as contact info after the task. The bot tells you what it kept. If

4:28you don't want something kept, say so. Number four, web pages can try to trick a bot. It's called prompt injection. XAI's own security docs say their defenses reduce, but do not eliminate that risk. Which is one more reason to keep anything that matters behind an approval you control. Number five, approvals are getting quieter. The latest update says auto review asks less often for an action you asked for in your own words. You can push back. In settings, general, auto review, add an ask first rule for purchases. Ask first rules always stop a matching action, and they win over allow automatically. But, auto review is model based. Deciding

5:14what counts as a match is a judgment call. So, it helps, but it isn't a hard lock. And number six, housekeeping. Saved values are right only, so a blank field doesn't mean something was deleted. Logins and cards are only removed in settings vault. And that password export file, still plain text, delete it. So, here's the average Alex setup. This part is our opinion, not the docs. Save your logins. That's the big win, and it keeps passwords off chat. Save your contact info if you're comfortable with

5:50the bot seeing it. Skip saving cards. When the bot needs to pay, use the one-time secure form with the save box unticked. And if a payment form doesn't show that box at all, stop there. It saves straight to the vault. Add an ask first rule for purchases and checkouts. And once a month, open settings vault

6:11and delete anything you don't use. Quick recap. Logins, save them. Cards, think twice because a saved card doesn't ask. Purchases, put them behind ask first. Every fact in this video is footered to its source and the links are in the description. That's the vault the safe way. Quick note before you go. This channel is for education only. It's not professional, legal, or security advice and it doesn't replace reading the official docs and understanding how your tools work. You're responsible for what

6:47you set up and what you let your AI do. We're not liable for any loss or damage that comes from using these tools carelessly. Thanks for watching. See you in the next one.