Elon Musk’s Grok AI Shopping Demo Exposed Personal Order Details—and Invited LEGO Pranks

Elon Musk’s attempt to showcase Grok’s AI shopping capabilities quickly became a lesson in the risks of sharing sensitive purchase information online.

Musk apparently said this while giving X a shoutout for how helpful its Grok AI agent was in ordering a LEGO Star Wars kit on Sunday. Through screenshots, his more than 240 million followers were shown the 10-digit LEGO order number, the set’s price, shipping and billing address, the last four digits of his credit card, and the email address Grok used to purchase the bricks from LEGO. Musk’s post revealed the details.

Faster than the Millennium Falcon could reach lightspeed, the inevitable happened. An X user named Enderman posted a screenshot of an interaction with LEGO’s customer service chatbot. The screenshot appeared to show that Enderman had used Musk’s publicly shared email address and order number to prompt the system to cancel the order.

Musk’s Public LEGO Order Becomes a Target

Within hours, presumably to confirm whether Enderman’s plan had worked, Musk replied that his order had not been canceled after all.

By then, however, the risks of posting purchase details on his account were clear. Another X user appeared to return to LEGO’s AI assistant, called “Sophia,” and resume the order using the same information. The user increased the order to 400 sets and changed the shipping address while using Musk’s payment method. “Perfect! Getting your LEGO adventure back on track,” Sophia replied, according to a screenshot posted to X.

Increasing the order to 400 sets may even have been conservative. WIRED’s Spend Elon Musk’s Money Tracker shows that, if Musk wanted to spend $1 billion on plastic bricks, he could have purchased $1,000 LEGO Death Star sets, each containing 9,023 pieces. LEGO lists the Death Star set here.

When WIRED contacted LEGO to ask whether the actions involved Musk’s personal Star Wars order, the company declined to comment. However, unusual activity may have occurred during the purchase, suggesting that LEGO’s AI assistant safeguards could have benefited from a live human reviewing the requested changes.

The Risks of AI Shopping Agents

On Saturday, Musk hinted that Grok would soon be able to make online purchases with a simple prompt. In the post, Musk suggested that users could upload a photo of their credit card and ask Grok to search the web for deals and complete a purchase. AI companies including Meta and OpenAI have also promoted the usefulness of their agents for shopping tasks.

However, late last year, Visa warned about fraud in agentic commerce. The company said malicious actors could create websites that resemble legitimate retailers and trick AI agents into purchasing counterfeit products by offering equipment at unusually low prices.

“Once an AI agent completes a purchase, malicious sellers can collect payment data and immediately use it for fraudulent transactions,” Visa wrote. The company also reported that malicious bot-initiated transactions rose by 25% in the second half of 2025. In the United States, the increase reached 40%.