When you paste a secret into Grok Bot chat

If you paste a webhook secret, API key, password, or other credential into an ordinary Grok Bot message, that text stays in the transcript. Staff (kevinn, Sep 17, 2026) on the redact request: deleting or redacting a sent message is not possible today. The only per-message Delete is for messages that failed to send. Treat a successful paste as permanent for that conversation.

Rotate the leaked credential first

1. Identify which provider issued the value (webhook host, cloud console, password manager entry).
2. Invalidate or rotate that secret on the provider immediately so the pasted copy is useless.
3. Create the replacement secret in the provider UI, not by asking the Bot to invent one.
4. Do not paste the new value into chat. Use the secure request path below.

Rotating is the only recovery for text that already landed in the transcript. Hiding the Bot, Reset chat, or deleting the Bot does not reliably erase history that other systems may already have stored.

Hand credentials with the secure input card

Going forward, ask the Bot to request the credential instead of pasting it yourself. Staff’s guidance: the Bot shows a secure input card with a masked field, saves the value as a secret for that Bot, and the value never lands in the transcript or in the model’s context.

Example ask:

I need to give you the webhook signing secret for this integration. Request it with the secure secret card — do not ask me to paste it in chat.

Complete the card when it appears. Confirm later tool calls use the saved secret name without echoing the raw value.

For computer logins and CAPTCHAs that need your eyes, use Take over on the Agent Computer instead of typing passwords into the chat composer. See Take over Grok Bot’s computer for sensitive steps.

Pitfalls

• Looking for a redact or edit-own-message control on a successfully sent message — product has not shipped one.
• Pasting the rotated replacement into the same chat “just once” — use the secure card every time.
• Assuming Delete on a failed-to-send draft means successful messages can be removed the same way.
• Leaving the old provider secret live after a chat paste — rotate first, then store the new value as a Bot secret.