Elon Musk's Grok Lego Purchase Reveals AI Shopping Risks
Elon Musk's attempt to showcase Grok's shopping skills led to exposed order data and prank modifications via Lego's customer service bot.
Elon Musk recently took to X to highlight the capabilities of his Grok Bot AI agent by sharing a success story about purchasing Lego Star Wars kits. However, the screenshot he posted to his massive audience of over 240 million followers inadvertently exposed sensitive data. Visible details included a 10-digit Lego order number, pricing information, billing and delivery addresses, the last four digits of a credit card, and the email address utilized by the bot.
Quickly spotting the error, another X account holder named Enderman used the leaked email and order number to interact with Lego's customer service chatbot. According to screenshots shared online, the user managed to prompt the system into canceling the billionaire's purchase. Musk later responded within a couple of hours, stating that his order remained active, potentially testing whether the cancellation scheme had truly worked.
Following that incident, a different X user engaged Lego's AI assistant, named Sophia, using the same exposed details. Screenshots suggested this user successfully reopened the delivery, altered the shipping address, and multiplied the order quantity to 400 sets while retaining Musk's original payment method. The chatbot reportedly confirmed the changes by stating it would get the adventure back on track. When contacted for comment, Lego declined to confirm whether these specific modifications actually took place on the personal order, though internal safety systems or human reviewers may have intercepted unusual changes.
The push for agentic commerce
Prior to the incident, Musk suggested that users could enable Grok to handle online shopping by uploading a picture of a credit card so the bot could locate deals and complete transactions. Major tech players including Meta and OpenAI have similarly promoted the usefulness of autonomous agents for managing shopping tasks.
Despite the growing push toward automated shopping assistants, security warnings have accompanied the trend. Toward the end of the previous year, Visa issued warnings regarding fraud risks within agentic commerce. The payment company cautioned that malicious actors could construct legitimate-appearing websites designed to deceive AI agents into buying counterfeit items through heavily discounted prices.
According to Visa's findings, once an autonomous agent completes a transaction, fraudulent merchants can harvest payment information and immediately execute unauthorized charges. Visa noted a 25 percent global increase in malicious bot-initiated transactions during the latter half of 2025, with the figure spiking to 40 percent specifically within the United States.
What it means for developers
For engineers building and testing autonomous agents, the Lego shopping incident and industry security warnings highlight critical vulnerabilities in automated transactions. As developers deploy AI systems capable of interacting with external APIs, handling sensitive user credentials, and executing financial tasks, strict input validation and secure session management become paramount. Protecting user data and preventing prompt-based manipulation of customer service bots remain significant hurdles for the industry.
Developers looking to build, test, or integrate these capabilities can try top AI models cheaply through one API at https://apixoai.online.
Source: Elon Musk Bragged About His Grok Lego Star Wars Haul. Then X Users Punked Him — Wired AI. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
