Grok Bot and your Google business profile: what we tried and where the risk is

Grok Bot can sign in to your tools and work in them on its own. We tried it on a Google business profile and read its official rules. Reading and drafts worked, but an important question about publishing remains open.

What Grok Bot is

It is an AI teammate with its own cloud computer. It isn’t the same as Grok chat: Bot uses a browser and connected apps and keeps working with your laptop closed. It comes with plans at USD 30, 100 and 200 a month, excluding taxes (as of 5 Nov 2026).

How we tested

One trial on one profile that we manage ourselves. It is a small online shop outside Czechia with no reviews. The bot was only allowed to read and prepare drafts. It reported the results itself and backed part of them with screenshots. This is a first trial, not a measurement: it says nothing general about Prague businesses.

What worked

• Managing the profile in a browser. The bot opened the business panel and read the name, category, address, opening hours and statistics. The owner confirmed the first sign-in by phone. During the test there was no CAPTCHA or security warning.
• Firmy.cz and Mapy.com. Both sites opened without being blocked. We couldn’t compare data because the test business isn’t listed there.
• Draft texts. It prepared a post in Czech, Ukrainian, Russian and English and marked what it had inferred from the website’s name. A Czech draft reply to an enquiry, based on an invented price list, asked about the area, timing and the flat’s condition and gave no final price.
• Background work. A task scheduled for 18:10 started at 18:19, ran without a person and, according to Bot’s report, published nothing. So we don’t promise exact start times.

What didn’t work or remains unverified

• Numbers. For interactions, Bot gave three different totals: 183, 191 and 209. So we don’t put such numbers in a report without a human check.
• Address. The bot found two different addresses for the business. We didn’t check why, so a person has to review this.
• API conditions. The bot found the official page and prepared an application text, which it didn’t send. It couldn’t see the profile’s verification or age on screen.
• Review replies. The profile has no reviews, so we didn’t verify this.
• Staying signed in. The sign-in lasted until the next start, but one trial says nothing about when Google will ask for verification again.
• Limits. Going by the balance before and after, the whole trial on the Premium plan used about 1.7 % of the weekly limit. But the profile had no reviews or posts, so normal work will use more.

The main risk: the Publish button

The bot reached the publish button and, as instructed, didn’t press it. No confirmation card appeared before it, so only our instruction stopped it, not the system. Whether a card would appear after pressing, we haven’t verified. Nor do we have confirmation that the “ask first” rule was switched on at that moment.

According to the documentation, automated review also covers browser work, and you can set an “ask first” rule. But the review is model-based, and the documentation itself calls it a complement to, not a replacement for, firm boundaries. Until shown otherwise, assume a signed-in Bot can do in your profile whatever you can.

What the rules say

• Responsibility. Grok Bot’s terms say the customer is responsible for its actions and that human review should precede outward communication.
• Internal work only. The same terms permit use for a business’s internal purposes. It isn’t a chat for your customers.
• A shared computer. All bots on an account share files and sign-ins. A separate bot is not a security boundary.
• Data in the US. The computers run in the United States, and sign-ins and files stay on a persistent disk. Sharing customer data needs a separate assessment.
• Google’s official API. It requires a verified profile active for at least 60 days and a website. The API policies require the user’s prior express consent for automated replies. They say nothing about an agent signing in through a browser.

Connections: what we found in the catalogue

The bot searched its app catalogue. It found no ready-made connection for the Google profile, Firmy.cz, Fakturoid, Pohoda, Reservio, Altegio or Kommo. Postiz (post scheduling) and WhatsApp Business are listed, but we didn’t try them. Instagram, Facebook and Telegram are only available inside Postiz. We didn’t try Fakturoid in the browser. This comes from Bot’s search rather than a screenshot of the app window, and the catalogue may change.

How we would start

• One role, reading first. The documentation recommends this too: for example, draft review replies.
• A person presses the button. Bot prepares the text; you check it and publish it yourself. This is a working rule, not a technical lock.
• Apply for the API in parallel. Once Google approves access, writing can be built so that Bot has no right to publish directly.
• No bank, datová schránka or saved card. A card in Vault is used at checkout without a separate confirmation.
• A spending limit from the start. Turn off auto top-up or set a monthly limit.
• Sign out after the trial. The Google sign-in stays on Bot’s computer until you sign out.

What we don’t promise: that Bot will move your business up the map. According to Google, relevance, distance and prominence decide. The product also changes quickly, which is why claims here link to sources where you can check the current state yourself.