Elon Musk’s public sharing of a screenshot showing his Grok AI-assisted Lego Star Wars purchase revealed private payment and delivery information, allowing X users to manipulate his order through Lego’s chatbot.
- Musk revealed detailed Lego order and payment info via Grok AI screenshot.
- X users exploited Lego’s AI chatbot to alter and multiply Musk’s order.
- Incident underscores emerging AI security vulnerabilities in shopping bots.
What happened
Elon Musk shared a screenshot on X showing his Grok AI helping him order Lego Star Wars sets. However, the image unintentionally exposed sensitive details including the order number, addresses, part of his credit card, and the email Grok used for the purchase. Armed with this info, X users engaged Lego’s customer service chatbot to cancel or expand the order, inflating it to as many as 400 sets.
Although Musk later confirmed the order was not canceled, other attempts succeeded in reopening or modifying deliveries. The Lego AI chatbot, called Sophia, responded affirmatively to these changes. This public incident highlighted how easily AI-driven purchasing can be manipulated when private transaction data is exposed online.
Why it matters
This episode with Musk’s Lego purchase reveals critical risks in agentic commerce—where AI agents autonomously shop using stored payment and personal information. If such details are leaked or intercepted, malicious actors could hijack orders, generate fraudulent purchases, or harvest sensitive data. This is particularly concerning as AI shopping bots become more widely adopted.
Security experts like Visa have flagged such threats. In 2025, Visa reported a surge in malicious transactions initiated by bots, warning that scammers create fake storefronts to trick AI agents into unauthorized purchases. Musk’s case exemplifies what can happen even with reputable retailers when transaction specifics are publicly broadcast.
What to watch next
As AI assistants like Grok gain traction for autonomous online shopping, companies must implement stronger protections against data exposure and unauthorized order changes. Monitoring for suspicious AI interactions and involving human review where anomalies occur will be key to preventing exploitation.
Consumers should also exercise caution when sharing screenshots or transaction details online that might reveal private payment or order information. Meanwhile, developments in regulatory guidance and AI safety practices concerning financial data handling by shopping bots will be closely watched in the coming months.