Should you give Grok Bot your Xero login?

1. What Grok Bot actually does

xAI launched Grok Bot in beta on 11 August 2026. You create named AI teammates, called Bots, and message them like a colleague. Each one works on a cloud computer with its own browser, files and terminal. It signs into the websites and apps you use, clicks through them the way a person would, and keeps going while you are away. When it reaches a password, a two-factor code or a payment, it hands the screen back to you to type, and the model never sees what you typed.

It comes with the higher Grok and Cursor plans. Prices and plans have changed since launch, so check xAI’s own site rather than any figure you read in an article, including this one. Everything below is as we found it on 19 October 2026, and the product ships a new version most weeks.

2. Logged in as you, it is you

The password stays out of the model. The session does not. Once you type your Xero password into the Bot’s browser, that browser is signed in as you, and three things follow:

• Your permissions, all of them. If your login can approve bills, edit pay runs or open forty client organisations, the Bot can too. Xero has no way to tell the two of you apart.
• Your name on the history. Every change the Bot makes shows in Xero’s history and notes under your user. When a client asks who changed an invoice, the honest answer is “my login did”.
• Every Bot shares it. xAI’s own documentation says all your Bots share one cloud computer, and the browser sessions on it are available to every Bot on your roster. The Bot you set up for supplier portals can reach the Xero session you opened for another one. xAI says not to treat separate Bots as separate security boundaries.

3. What Xero’s terms say

Xero’s terms of use ask you to protect your username and password and not let any other person use them. They also make the subscriber responsible for everything invited users do. Whether a Bot counts as “another person” is a question for a lawyer, not for us.

What is not in question is the design Xero gives you instead: invite each user, choose their access, and change or remove it any time. Xero built that so nobody has to share a login. A Bot on your own login skips it.

4. Where the client files go

Cursor, which runs the Bot computers, confirmed on its forum in August that they run on US cloud infrastructure and there is no region choice. We could not find a published retention period or a security certification in the Grok Bot documentation, and storing your data is not optional.

That matters because of how the Privacy Act treats information sent overseas. Under APP 8, before you disclose personal information to an overseas recipient you have to take reasonable steps to make sure they handle it the way the Australian rules require. Under section 16C, if they mishandle it, you are accountable as if you had done it yourself.

A Xero file is full of personal information: customer names, addresses, phone numbers, bank details on bills, and for many businesses, payroll. The Act applies in full to businesses over $3 million turnover and to some smaller ones, and many practices are bound to it by their client agreements anyway. Our compliance paper covers who it applies to.

5. If you are a registered tax agent

The Tax Practitioners Board published guidance on AI in July 2026. It applies Code item 6 directly: you must not disclose a client’s affairs to a third party without the client’s permission, and entering client information into an AI tool can be exactly that, depending on how the tool is set up. It also says AI does not move responsibility for the work off the practitioner.

A Bot signed in as a practice partner can open every client file that partner can. So the permission question is not “did this client agree?” but “did every client this login can reach agree?”. A standard engagement letter written before agents existed probably does not cover a computer in Oregon reading the ledger overnight.

6. What approvals catch, and what they miss

Grok Bot asks before the actions you tell it to ask about, and xAI suggests boundaries for the right things: sending messages, payments and transfers, deleting or overwriting data, changing permissions. That is a sensible list. Four limits are worth knowing before you lean on it:

• Boundaries are written in plain English. They are instructions the Bot follows, not permissions the software enforces. Xero’s own user roles are enforced; a sentence in a prompt is not.
• “Always allow” is one click away. Approving a repeat action can create a standing rule. On a busy day, that is how a check quietly disappears.
• Approval does not undo. In xAI’s words, an approval controls the proposed action and does not reverse work already completed. Whatever the Bot changed on the way to the question stays changed.
• There is no practice run. A test run does real work, and a per-action audit trail was listed as coming, not shipped, when we looked.

None of this makes the tool careless. It means the fence is the Bot’s good behaviour, and for a ledger you want the fence to be the system. This is the same argument we make about just using Claude: the model is capable, and capable is not the same as checkable.

7. Where it genuinely helps

A Bot that clicks is built for websites with no proper way in: a supplier portal with no API, a council form, a wholesaler’s price list, a booking site that only works in a browser. For those, it may be the first thing that can do the job at all, and the logins at stake are usually low risk.

Xero is the opposite case. It has a proper door: an API, a free read-only connector for Claude, and an app marketplace of tools that connect with limited, revocable access. A Bot clicking through Xero’s screens is doing the hard way what the easy way already does better, and it can break when Xero moves a button. Also worth knowing: some sites block the Bot’s US cloud address before the login page even loads, and Cursor has said region choice is not available yet.

8. The safer setups, in order

Start with the connector. For questions like “who owes me more than $5,000?” it is free and cannot change anything. Our guide to connecting Xero to Claude walks through it.

If you want a Bot in Xero anyway, give it a user of its own. Bots now have their own email addresses, so you can invite one into a single organisation with read-only access, the way you would a new junior. Keep it off payroll, off bank details and off every other client. We have not run this end to end, so test it on your own practice file first.

For anything that writes, use something that goes through the API with the narrowest scope the job needs and a person approving each change. The Two Records standard sets the rule we hold ourselves to: show the difference, change nothing until a person accepts it.

9. Build the Monday debtor list yourself, in Grok Bot or Claude

The most common thing people want from an AI on Xero is a list every Monday morning: who owes what, ranked by what it is worth to chase. Here is how to build it in each tool, with the same prompt. The steps are as each tool set them out on 19 October 2026; menus move, so expect the odd label to differ.

The prompt, for either tool

It follows the ranking rules in our Debtor Chasing standard: group by customer, sort into four buckets, rank by amount rather than age.

Use the Xero connector, read only. Open [organisation name] and run the Aged Receivables Detail report as at today.

For every sent invoice past its due date, collect five fields: customer, amount outstanding, days past due, the customer's mobile number from their contact record, and the last note on the invoice. Leave out drafts and invoices awaiting approval.

Group by customer: one customer with several invoices is one line, with the total.

Put each customer in one bucket, by their oldest invoice:
- Broken promise: a note shows a promised payment date that has passed. This bucket comes first.
- Just late: 1 to 14 days.
- Drifting: 15 to 44 days.
- Hard: 45 days and over with no contact logged.

Rank by total amount outstanding, largest first, with age breaking ties.

Save the list as debtors-YYYY-MM-DD.csv. If last week's file is there, mark any customer who has dropped off as "paid or cleared since last run".

Give me the top ten as a table, and the count of overdue customers with no mobile number. Do not change anything in Xero and do not contact anyone.

In Grok Bot

1. Click + beside Bots and name it “Monday Debtors”. In Edit Profile, put the standing rules in the description: read only, this one organisation, never contact a customer, ask before changing anything.
2. Open Plugins and add Xero. It asks for a client ID and a client secret.
3. To get those, sign in at developer.xero.com, create a new app of type custom connection, tick read-only scopes for transactions, contacts and reports, and pick the organisation. Someone with admin rights on that organisation approves it from an email Xero sends. Custom connections on a live organisation carry a monthly Xero fee; check the current price on Xero’s developer site.
4. Paste the client ID and secret into the plugin. Treat them like a password: anyone holding them can read that file.
5. Paste the prompt into the Bot’s chat. When the table looks right, ask it to “save this as a skill called Monday debtor list, and create a routine that runs it every Monday at 8am Brisbane time.”
6. For a practice: repeat steps 3 and 4 for every client. One custom connection covers one organisation.

You can skip steps 2 to 4 by letting the Bot sign into Xero in its browser instead. Sections 2 to 6 are why we would not.

In Claude

1. In Claude’s connectors, add Xero, sign in with your Xero login and choose the organisation. No keys, no developer portal.
2. Open the Claude desktop app, start a Cowork task with a folder for the lists, and paste the prompt.
3. When the table looks right, type /schedule and choose weekly, Monday, 8am.

Side by side

For the list itself, Claude is the easier build by a distance, and it is a good first step. Grok Bot earns its keep on the websites that have no connector at all.

What neither of them does

Both end with a list in your inbox on Monday. Xero’s own aged receivables report was already most of that list. The work that gets you paid starts after it, and neither tool does it:

• Ring the customer, say it is an AI, and stay inside calling hours and the Do Not Call Register.
• Re-read the invoice just before the call, so nobody is chased for a bill paid on Friday.
• Leave the call with a date, and write that date back to the invoice in Xero.
• Hand a dispute to a person instead of sending another reminder.

That is the part we built.

10. Before anyone signs it in

Staff will try new tools before anyone writes a policy. Five questions are enough to have an answer ready:

1. Which Xero organisations can this login open?
2. Has every client behind those organisations agreed to their data going overseas to an AI provider?
3. Can the job be done read-only, through Xero’s connector?
4. If not, does the Bot have its own user with the least access the job needs?
5. Who checks what it did, and where is that written down?

If a question has no answer yet, the Bot stays out of Xero until it does. Put the answers in one page and send it to staff and clients before someone asks.