Diving into the Grok Bot black box (files, folders, memory, instructions)

I've been poking at Grok Bot before trusting it with anything real. What got my attention is that it's already built a lot like an ICM workspace. Every account gets its own computer with a /workspace folder, and the bots read and write files there. So I set one up the way I'd set up mine: an AGENTS.md at the top, a log, and some tests. Then I tried to break it.

This was the web version, one bot (Scout) plus a throwaway second agent to mess with it. Here's what I found.

1. The router isn't guaranteed to get read. Scout had a note in memory to read AGENTS.md before every task. The second agent rewrote the file to v3 behind its back, and Scout's next log line still ended in v2.

2. The description box is where the instructions actually live. Think project instructions. The docs say personal bots don't have one anymore. The web app still does, and it gets read every turn. I put "start every reply with Scout here" in it and that's what it did. When I had Scout research this, it pointed out the docs line and then said, more or less, I'm a personal bot and I clearly have one that I follow every turn.

3. The chat is the memory. Each bot runs one long conversation that gets summarized as it goes. Here we close out and start fresh to control context. Over there you spin up a new bot or duplicate one, and the docs are pretty vague about it. I tried a thread to get a clean start and it still knew a code word from the main chat.

4. Any bot can change the rules. Every bot on the account shares the same workspace. I put a fingerprint lock in the description (stop if the file's hash changes) and it worked for a changed file. Then the second agent edited Scout's description box itself, and Scout can edit its own with one tool call. xAI's own FAQ says don't use separate bots as a security boundary. They mean it.

5. The log caught what the chat didn't. The reply looked fine every time. The one line per task log is where the v2 showed up.

The simpler way to think about it: make the bot's description box a thin pointer to AGENTS.md, so the file gets read every turn. Mine says "before every task, run cat /workspace/AGENTS.md and follow what it says now, not what you remember." The real rules live in the file, and everything gets logged. Files, folders, and rules that survive any model. Same stuff we care about in here.

Where I'm heading next: the desktop version, in a sandbox, to see how it plays with real files and folders on a computer. And honestly, I don't see Grok Bot running my workspace. It's looking more like a handoff. My workspace stays where the rules and the knowledge live, and Grok Bot gets jobs: its computer, routines and bots handling tasks and tracking, then handing the results back.

Question for the room: anyone running Grok Bot against an ICM style workspace yet? How are you handling who gets to change the rules?

If you want to watch me talk through my first impressions as they relate to ICM and our knowledge bases, the video's here. Apologies ahead of time.

https://youtu.be/JUXVIQT90Ew

P.S. Show your work bit: Scout logged the research run for this post with "(rules v4)" on the end, so the marker's still holding. For now.

11 comments

Diving into the Grok Bot black box (files, folders, memory, instructions)