Grok Bot gains private Tailscale access, with permissions left to policy

The rollout also predates the latest promotion. Grok Bot's November 4 changelog, for version 0.78.5, listed personal-tailnet connections and a chat card for requests needing a Tailscale device. It also said scheduled routines could run on the bot's computer while connected to a tailnet, running only what the user sends it themselves.

A November 3 entry already directed users with private Tailscale MCP servers to connect through the plugin and try again. The November 4 listing therefore documents availability, rather than establishing the first release date.

The official Grok Bot account promoted access to personal and company tailnets on November 10, according to the report. The account's claim covered company as well as personal networks; the November 4 entry specifically named personal tailnets.

The earlier limitation was explicit. In its October 11 release notes, Grok Bot said it could not yet reach an MCP server on a private Tailscale network and suggested exposing it through Tailscale Funnel. The November integration provides a direct private-network option instead of that workaround.

User identity does not settle the permission boundary

Tailscale's existing OAuth clients create tag-owned devices under a shared service identity. Its OAuth apps instead use a standard OAuth 2.0 authorization flow on behalf of the consenting user. Tailscale says the resulting devices remain subject to tailnet access policies, audit logs and device quotas, without users pasting keys or secrets into the integration.

The distinction matters for accountability, but administrators still need to decide what the bot can reach. As the report notes, citing Tailscale's documentation, a new tailnet's default policy permits its devices to communicate with one another. Private connectivity and narrowly scoped connectivity are separate configuration choices.

Tailscale illustrates the narrower approach with an engineering team: engineers' ordinary devices can access production databases, while Grok Bot devices associated with those same engineers can reach only designated MCP servers. Its example explicitly excludes bot devices from the ordinary access rules before granting the limited exception.

That setup uses a custom device-posture attribute available on Tailscale's Premium and Enterprise plans. On other plans, Tailscale says users can apply a tag to the bot's device after authentication and use tag-based rules for similar control. Those plan requirements apply to custom posture attributes; paid posture checks are not the only way to restrict access.

Network access is also distinct from permission to use a connector. Grok Bot's November 3 changelog says plugin installations follow a team's allowlist and blocked installations identify the administrator's MCP restriction. Its October 26 notes also say custom MCP servers using a private certificate authority work once the user approves that authority. Deployment can therefore require connector permission and certificate approval as well as a network route.

The underlying OAuth apps capability is also available for developers building their own integrations. Grok Bot is Tailscale's production example, rather than the only assistant that could use the mechanism.

The deployment decision still rests with administrators

The November 10 promotion and November 4 changelog do not specify which Grok Bot subscription plans include the integration, the report notes. An October 27 changelog entry also said the Tailscale plugin would show “Not available yet” on accounts that could not use it. Tailscale's plan requirements for custom posture attributes answer a different question from eligibility on the assistant's side; the cited integration announcements do not establish a complete deployment price.

The report also places the promotion after complaints about usage limits and model routing. Private-network access addresses reach, and the cited announcements provide no measured gains in task completion, latency or business productivity. For an organization considering deployment, the next concrete decision is which internal MCP servers the bot should reach, whether its account is eligible, and whether its configured rules actually exclude the other resources its human user can access.

England’s university regulator pushes AI-free tests and AI skills

The Office for Students wants more AI-free assessment and better AI skills teaching, backed by existing quality rules. Its research raises doubts about unsupervised coursework, but universities say assessment reform is already under way.