Grok Bot vs Claude Cowork vs ChatGPT

01They all launched in eight months and say the same thing

Cowork went out in January as a desktop research preview, then to web and mobile on July 7. OpenClaw went viral in late January. Hermes shipped February 25. ChatGPT's agent launched July 9 on GPT-5.6. Grok Bot is the newest, on August 11.

The positioning lines up almost exactly. A teammate, not a chatbot. You give it a goal instead of a prompt. It keeps working after you close your laptop.

Five labs with different incentives landed on the same shape inside eight months. That says more about what the technology currently allows than about any one product team. So the pitch won't separate them. Where each one runs will.

02Where the computer runs

Every one of these has to solve the same problem, which is that an agent needs to touch your stuff. There are three ways to do that and each product picks one.

Run on a cloud machine and log in as you. The agent gets a browser and uses your real accounts through the real web interfaces. Reaches everything, including software with no API. Holds your actual credentials. That's Grok Bot.

Run on your machine, on files you hand it. Local sandbox, reaching outside through connectors you approve. Less reach, much smaller blast radius. Cowork does this, and so do OpenClaw and Hermes, except self-hosted with no vendor in between.

Run in the vendor's cloud through official connectors. No credential handoff, no browser puppeteering, only the integrations that already exist. Closest to ChatGPT.

Once you know which bucket something is in, you can predict its price, its reach and its failure modes.

03Grok Bot: every bot shares one computer

It's from SpaceXAI now, the entity that came out of SpaceX acquiring xAI in February. In June, SpaceX agreed to buy Anysphere, the company behind Cursor, for $60 billion in stock. That deal closed in the middle of this month, days before I wrote this.

That matters, because the product ships through Cursor's stack. Per xAI's own docs, authentication, privacy settings, retention and deletion all resolve to Cursor rather than xAI.

The product itself is good. Named persistent bots, each with a system prompt, on a cloud Linux machine with browser, filesystem and terminal. Two features nobody else shipped this cleanly. It will record up to ten minutes of you doing a workflow, browser only and no audio, and turn it into a draft skill you review. And bots message each other asynchronously, with group chats of two to six and the handoff visible in the transcript.

The short write-ups mostly get the next part wrong.

All of an account's bots share one persistent cloud computer. They share its files, its browser sessions and its app logins. Each bot gets its own screen on that one machine, which is a work surface rather than an isolation boundary.

The practical version: sign into a bank, a payroll system or anything holding regulated data on that machine, and every bot on your account can reach that session. If you pictured one bot per machine, correct that before you connect anything.

The model powering Grok Bot isn't publicly named anywhere, and press guesses at a version number. For a product you hand credentials to, I'd want that stated.

On price, be careful with the numbers going around. Access is still the same three tiers it was on day one: SuperGrok Heavy at $300 a month, Cursor Ultra at $200, and Cursor Teams Premium at $120 a seat. SuperGrok Plus and Cursor Pro+ exist and do not include Grok Bot. No free tier, and the seven-day trial some posts mention doesn't appear in the documentation.

04Claude Cowork is the opposite bet

Seven months of hardening versus Grok Bot's ten days, which is not nothing in a category this new.

Architecturally it's the mirror. Cowork runs in a containerized Linux sandbox on your own machine, works on files you explicitly grant, and reaches services through connectors and a Chrome extension. Sandbox traffic is forced through a proxy with an allow list, and connector tokens never enter the sandbox. Grok Bot runs on a cloud computer it owns and gets to your tools through the same web interfaces you would use, no integration required.

Grok Bot reaches more, because a browser can log into anything. Cowork reaches less and knows exactly what it touched.

Price gap is big too. Cowork rides along with Pro, Max, Team and Enterprise, so $20 is the door. Grok Bot's cheapest entry is six times that.

Where Cowork can't help: if your workflow lives in a system with no connector and no API, it can't get there. That's the hole Grok Bot was built for. One old complaint about it is now out of date, though. Since the July expansion, a task started on desktop keeps running in the cloud with the laptop shut.

05ChatGPT

The least flashy of the five, and probably the one most enterprises land on.

OpenAI ships the agent side of ChatGPT as ChatGPT Work, launched July 9 on GPT-5.6. Works over connected apps and files, produces documents, spreadsheets, presentations and web apps, and keeps running in the cloud after you close the app. OpenAI frames it as moving ChatGPT past answering questions and toward finishing work, which is close to word for word what SpaceXAI says about Grok Bot.

It does drive a browser, but not a logged-in one. The cloud browser handles public pages; anything authenticated goes through connectors. That's the whole architectural difference from Grok Bot.

Better pick when your tools have solid connectors and you mostly need messy inputs turned into something reviewable. Safer for anything stakeholder-facing.

It runs subagents too: the parent spawns specialists in parallel, routes the work and merges the results. That makes multi-agent less of a Grok Bot differentiator than it looked on launch day.

06OpenClaw got hit first

OpenClaw is open source and self-hosted, built by Peter Steinberger in November 2025 as Clawdbot. It was renamed twice in four days under trademark pressure from Anthropic, first to Moltbot on January 27 and then to its current name on January 30. It went viral immediately, gaining around 25,000 GitHub stars in a single day and passing React's ten-year record in about sixty. Steinberger joined OpenAI on February 15 to work on personal agents, and the project moved to an independent foundation sponsored by OpenAI, NVIDIA, Microsoft and Tencent. As he put it himself, OpenAI hired him, not OpenClaw.

Then it became the first real AI agent security crisis. Every product in this post has the same shape of exposure. OpenClaw is the one with a public record.

CVE-2026-25253 was a one-click remote code execution via cross-site WebSocket hijacking: a crafted URL parameter made the control panel connect to an attacker's server and hand over its auth token. CVSS 8.8, patched at the end of January. It wasn't isolated. Command injection, server-side request forgery, path traversal that let attackers read local files, and prompt-injection-driven code execution all landed as separate CVEs. Later came a privilege escalation at 9.9 and a sandbox-escape race condition at 9.6.

The plugin registry got hit too. Koi Security audited all 2,857 skills on the registry and found 341 malicious ones, 335 of them part of a single campaign pushing a macOS infostealer. Over a hundred posed as crypto wallet tools. Later audits at larger registry sizes kept finding malicious packages in the hundreds, though the rates reported vary enough that I wouldn't quote a single one.

Exposure counts are all over the place. Censys counted 63,070 live instances at the end of March. SecurityScorecard found 42,900 exposed control panels across 82 countries. Earlier scans in January found a few hundred, later ones ran into six figures. I'm not picking a number, because they don't agree with each other. What is consistent across all of them is that most exposed instances had no authentication at all, because early versions bound to every network interface with no login required.

Microsoft's security team wrote in February that OpenClaw "should be treated as untrusted code execution with persistent credentials" and "is not appropriate to run on a standard personal or enterprise workstation." Kaspersky said use a spare machine or a VPS, never your primary. NVIDIA shipped an enterprise security wrapper for it at GTC in March. China's industry ministry issued a public warning that bad configuration could expose users to attacks and data leaks.

A normal application has a defined scope, so you can put controls at each boundary. An autonomous agent has no fixed scope by definition, because the whole point is that it can do anything you could do. That's true of the category, not of OpenClaw specifically. It got hit first because it was open, popular, and deployed by a lot of people faster than the defaults could keep up. To the project's credit the fixes shipped quickly and the defaults changed.

07Hermes picked up where OpenClaw left off

Released February 25 by Nous Research, MIT licensed, self-hosted, and widely treated as OpenClaw's technical successor. It ships a migration command that imports OpenClaw personality files, memories, skills and API keys straight over.

The real difference is how much a human stays in the loop. Both learn skills from work you've already done. OpenClaw holds a learned skill as pending until you review and apply it, while Hermes writes and starts using them on its own after a handful of tool-heavy tasks. Memory lives in a local SQLite database on your machine and skills sit alongside it as plain markdown files. Nothing goes through a third party.

Adoption is real. NVIDIA's own blog reported in May that it crossed 140,000 GitHub stars in under three months and was the most used agent in the world by OpenRouter's numbers. It's at roughly 234,000 today, up from about 47,000 in April, so treat any single figure as a snapshot with a short shelf life.

Then the timing. Nous shipped Bot Mode on August 18, three days ago: named reusable bots with their own model and memory that message each other. That's Grok Bot's flagship feature, in an open-source product, seven days after Grok Bot launched.

Self-hosted means everything in the OpenClaw section is now your problem.

08Nobody has benchmarked the products

Agentic benchmarks exist and the labs publish on them. OSWorld and GAIA for computer use, SWE-bench and Terminal-Bench for coding. Anthropic, OpenAI and xAI all report numbers.

Those numbers are for the models: Claude Opus, GPT-5.6, Grok 4.6. Nobody has published one for Grok Bot or ChatGPT or Cowork as shipped products, meaning the model plus its scaffolding, its browser, its permission prompts, and what it does when a page won't load. That scaffolding is most of what you're paying for.

So when a review says one of them finishes the work, that's someone's impression. It might be right. It isn't a measurement, and that includes every review I read for this post.

09How I'd actually pick

Write down what the agent has to touch. If everything on that list has an official connector, stop, and use the cheapest connector-based option. Most people are here and don't realize it.

If your work lives in something with no API, which describes a lot of real work in construction, healthcare, logistics and government, browser-driving is the only thing that reaches it, and Grok Bot is the most polished version right now. You pay for that with real credentials on a machine you don't control, shared across your bots.

If data can't leave your environment, you're self-hosting, and Hermes is the better-designed option with the more active project.

On compliance, I expected this to be the tiebreaker and it isn't. All three of Anthropic, OpenAI and xAI hold SOC 2 Type II, and all three gate HIPAA agreements, SSO and zero-retention behind enterprise contracts and a sales conversation. xAI shipped its business and enterprise tiers in December. If you're in a regulated industry you're having the same procurement call three times, not picking a winner off a page.

Never pilot on the real account. Run it on low-stakes work and keep sensitive accounts disconnected until it proves out.

And price the failure, not the subscription. A $20 agent reading files you handed it and a $300 agent holding your CRM password carry very different downside.

10What I'd watch

Whether anyone benchmarks the products rather than the models, because until someone does, this market runs on assertion.

Whether Grok Bot names its model.

Whether the multi-agent thing means anything, given ChatGPT already had subagents and an open-source project matched the rest in a week.

And whether the first serious commercial-agent breach lands. OpenClaw took the hit because it was open, popular and deployed at speed. I don't think the polished ones are structurally safer. Fewer people have tried.

Sources

Grok Bot: xAI's product page, launch post and docs, including the FAQ on the shared computer and the security-boundary warning. Reporting on the SpaceX acquisition of xAI and the $60 billion Anysphere deal from CNBC, Forbes and TechCrunch.

Claude Cowork: TechCrunch on the July expansion and Anthropic's engineering writeup on sandbox containment. ChatGPT: InfoWorld on the launch, plus OpenAI's docs on subagents.

OpenClaw: Microsoft Security (February 19), Kaspersky, The Register on NVIDIA's wrapper, Reuters on China's ministry warning, Koi Security on the malicious skills, SonicWall and ARMO on the CVEs, Censys and SecurityScorecard on exposure counts.

Hermes: Nous Research's repo and docs, and NVIDIA's blog (May 13) on adoption.

Dated because most of these numbers moved in the last month, and a few moved while I was writing. Anything wrong here is mine.