One person built twelve AI agents in eight hours

One person built twelve AI agents in eight hours. They all shared the same logins.

A guy I follow on Substack decided to test Grok Bot, a new AI product. He installed one app and started creating named agents with specific jobs. One handled Gmail. One worked LinkedIn. One managed his calendar. One planned travel. One researched customers. One led a landing-page project.

All twelve shared one cloud computer. Every browser session, every file, and every saved login belonged to all of them. When one agent needed something from another, it sent a message. No human relay required.

Grok Bot’s own documentation is blunt about it. All your bots use the same cloud computer. They share files, browser sessions, and app logins. Several bots can work at the same time “without getting separate security boundaries.”

The cost? It starts at $40 a month per seat. Consumer app. No IT setup required.

Sounds pretty sweet, right? Maybe not if you’re a blue team member.

Shadow AI used to mean one employee pasting customer data into ChatGPT. You could find that. It left traces in network logs. An AUP update and a training session covered most of the risk.

This is different.

Grok Bot doesn’t paste data into a chat window. It opens a browser. It clicks through your apps. It reads your email. It keeps working after the laptop closes. And it lives in a consumer subscription your IT stack never sees.

One employee. One consumer app. One afternoon. Twelve agents with access to your systems.

Think about that for a second.

There’s no OAuth grant in your SaaS apps. No SSO connection. Nothing in the integration list where you’d normally go looking. A CASB or your DNS logs might catch the app itself, if you’re watching for it. Most teams aren’t, because they’re still hunting for chat tools.

It’s a consumer app, like Spotify or Notion. And the agents use the employee’s saved browser session from a cloud computer you don’t control.

The docs don’t say which AI models run which tasks. There’s no setting to pick one. If your governance process requires knowing what AI is touching your data, you can’t answer that question here.

It gets worse. Grok Bot has a feature called “teach a task.” You screen-record yourself doing a workflow once, and the bot learns to repeat it. No API. No plugin. You just show it what to do.

The documentation caps that recording at ten minutes and warns you not to expose secrets while the bot is watching. Read that warning again, and picture who it’s written for. Your employee, mid-demo, showing a bot how to pull a report out of your CRM.

Two weeks ago I wrote about what happens when a company decides to give its AI agents full access to everything. That was a conscious choice. This is the version where nobody decided. The agents showed up because one employee thought it would be helpful.

We built our shadow AI controls for chat. This isn’t chat. It’s a workforce.

Here’s what to do.

Update your shadow AI question. Don’t just ask “Are you using AI tools?” Ask: “Do you have any AI tool that keeps working when you close your laptop?”
Check your acceptable use policy. Most AUPs cover pasting data into a chat window. Few cover granting browser sessions, saved logins, and file access to a team of persistent agents. If yours doesn’t mention agents, it doesn’t cover this.
Test whether your SSO catches this. If a login shows up from an unknown cloud computer using your employee’s saved session, does your identity system flag it? Or does it look like your employee working from a new location?
Add “AI agents” to your exit checklist. Deleting a bot does not sign it out of anything. The shared files and browser sessions survive, and clearing them is a manual job someone has to do by hand. When an employee leaves, their bot team still holds live sessions to your SaaS tools. Log them out everywhere, not just the devices you issued.

Have you found persistent AI agents running in your environment? Or is your shadow AI inventory still looking for chat tools?

-Kip