Personal
Second Google account for the bot: forward only what it should see
Bot email alone doesn't give you Drive/Calendar ACL control or a paper trail.
What hurt
Phil Whelan (@philwhln) created a second personal Google account for Grok Bot so he can manage access to calendars and Docs, and forward relevant Gmail (school, bookings, receipts). Bot-provided email doesn't solve Drive/Calendar ACLs. He may purge old mail to shrink compromise blast radius, and used a long hard-to-guess address to cut spam and prompt-injection via email. Not affiliated with xAI.
What to install or create
Second Google you control → ACL + selective forward → hard-to-guess address.
Bots
Household EA
Works inside the second Google with only forwarded, shared slices.
Plugins
Gmail
Required
Calendar
Optional
Routines
None on the first run. Watch one manual pass first.
The prompt
This is a tip, not a pasteable system prompt. The author did not publish one. Follow the first-run steps.
First run
- 1Read https://x.com/philwhln/status/2112670930791227723 (credit @philwhln).
- 2Create a second personal Google account with a long, hard-to-guess address.
- 3Share only the calendars and Drive folders the bot should touch.
- 4Forward relevant mail (school, bookings, receipts) into that account; skip the rest.
- 5Optionally purge old mail on a schedule to shrink compromise blast radius.
Approval fence
You own which folders/calendars are shared and which mail is forwarded.
What to tweak
Steal: don't hand your main Google; forward a thin, audited slice.
Source
Phil Whelan @philwhln · Original post
Not affiliated with xAI. We did not write this prompt. Third-party template terms still apply.
Pro pack
Want the full setup, not just the idea?
Pro packs give you the job text, prompts, schedules and pitfalls for popular use-cases.