Musk’s pitch for letting Grok Bot shop with a credit card backfired when his own LEGO demo exposed his order number, email address, and the last four digits of his card in an uncensored screenshot.
Last week, Musk praised the new AI agent and encouraged followers to let it control their credit cards and shop for them. “To buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok @Bot will scour the Internet for the best deal on the item you want and order it,” he wrote.
The next day, he posted a screenshot of Grok researching and ordering what he called “the most fun Lego Star Wars kits for young kids.” It showed Grok using a credit card, but also left personal and order details visible.
The screenshot gave pranksters material to work with. A user named Enderman posted screenshots that purported to show a LEGO customer service bot canceling Musk’s order. The post went mega viral. Musk replied angrily, insisting the order had not been canceled.
Whether or not the cancellation was real, others made more claims. One jokester demonstrated using the LEGO support bot to uncancel Musk’s order and place 400 more orders for the same product. The jokester also claimed to have changed the shipping address to Little St James, the infamous island owned by Jeffrey Epstein. Musk had discussed visiting the island in emails with the deceased sex trafficker. The claimed order and address changes were not confirmed as completed transactions.
The episode leaves a practical question unanswered. Musk’s post described uploading a photo of a card, but the public materials don’t explain how the photo is handled or whether this method has the same safeguards as Grok Bot’s documented payment flow, which includes an approval step and Stripe Link. LEGO declined Wired’s request for comment.
It’s probably not a good idea to let an AI agent, Grok included, control your financial information. Scammers have targeted AI chatbots to manipulate them into recommending or buying scam products. Tactics include setting up fake storefronts to phish for information and imitating defunct businesses. Giving an AI more permissions also creates more chances for a serious mistake, such as an agent posting bank balances and spending details in Slack.
