Fleet 2.9.1 is out.See what's new →
FleetFleet
Comparison

Fleet vs Grok Bot: A Linux Jail You Can Prove vs a Vendor VM

Grok Bot's VM has normal internet and shared credentials. Fleet jails Linux agents it launches. A grant names a host for a window.

Grok Bot is xAI's managed assistant. Its Linux VM has normal internet and shared credentials. That is a capable vendor environment. Fleet does not wrap it.

Fleet's job is different: keep Fleet-launched Linux agents from escaping. Default-deny network. A human allows a host for a bounded window. You prove that with fleet doctor and TestAcceptance_CompromisedAgentHasNoAlternateEgressPath.

OpenCode on Fleet can still run Grok-backed sessions. Those processes are Fleet-jailed. Grok Bot itself is a vendor VM. Cursor Cloud and Codex cloud VMs are the same class of machine.

Choose Fleet if

Teams that launch coding agents on a Linux host they control and need a jail they can re-run after every release — destination grants, human-only approve, fail closed.

Choose Grok Bot if

People who want xAI's managed Grok Bot with a normal-internet VM and shared credentials, without installing a local jail.

Fleet vs. Grok Bot: side by side

FeatureFleetGrok Bot
Process boundaryLinux user+mount+PID+net jail around Fleet-launched agentsxAI managed Linux VM; not Fleet-contained
NetworkDefault-deny. Unknown dest parks blocked_on_egress. Human grant is host/SNI for a bounded windowNormal internet
CredentialsNo ambient host creds in the box. Host inference broker owns model keysShared credentials on the vendor VM
What a grant authorizesDestination connectivity, not merge/deleteNot applicable — the VM is already on the network
Public prooffleet doctor + TestAcceptance_CompromisedAgentHasNoAlternateEgressPathNo Fleet oracle; do not use fleetctl.ai/sandbox as evidence
Grok modelsOpenCode (or another supported harness) can run Grok inside the jailNative Grok Bot experience on xAI's VM

Where Fleet is the better fit

  • A containment contract you can run: cannot escape, can request, cannot self-approve, human grant, fail closed
  • Destination-level honesty — grants are host/SNI, not actions
  • Does not pretend to jail Grok Bot, Cursor Cloud, or Codex cloud VMs
  • Source stays on your machine and goes only to your model backend and GitHub

Where Grok Bot is the better fit

  • No local namespace or iptables setup
  • Normal internet without parking on blocked_on_egress
  • Shared credentials are convenient when you want the bot to act as you
  • Native Grok Bot product surface instead of a local control plane

Pricing

Fleet: free tier (500 hosted starts), Business $299/org/month or $2,990/year, Enterprise custom. Model-provider fees are separate. Grok Bot access follows xAI's current Grok / X subscription terms — check xAI, not this page, for that price.

Do they compete, or coexist?

They coexist. Use Grok Bot when you want xAI's managed VM. Use Fleet when you launch agents on your Linux host and need them jailed. A Grok-backed OpenCode session started by Fleet is Fleet-contained; Grok Bot is not.

Frequently asked questions

Does Fleet sandbox Grok Bot?

No. Grok Bot's managed Linux VM has normal internet and shared credentials. That VM is not Fleet-contained. The jail applies to Fleet-launched Linux agents.

Can Fleet agents use Grok models?

Yes, when the harness you launch (OpenCode or another supported runner) can call Grok. That session runs inside the Fleet jail. That is not the same product as Grok Bot.

Is the /sandbox/ demo the jail?

https://fleetctl.ai/sandbox/ plays a saved workflow with no model. The jail proof is https://fleetctl.ai/security/#containment.

More comparisons

Fleet vs. Devin →Fleet vs. Codex CLI →

Keep your AI agents from escaping

Jail Fleet-launched Linux agents, then run saved workflows with review, approvals, and an audit trail. Prove it at /security/#containment.

See how it worksInstall Fleet