Elon Musk's Grok Lego Star Wars Post Leads to Exploits
A social media post detailing an AI-assisted purchase inadvertently exposed sensitive order data, prompting X users to tamper with the transaction.
Radwan AbdulhadiEditor and technology writer
An Inadvertent Exposure
Elon Musk took to X to crow about how useful his Grok Bot AI agent was in ordering some Lego Star Wars kits. However, by sharing a screenshot with his massive following, he managed to reveal much more than just his enthusiasm for the bricks.
The screenshot inadvertently displayed the 10-digit Lego order number of his purchase, what he paid for the sets, his delivery and billing addresses, the last four digits of his credit card, and the email address his bot used to buy the items.
X Users Target the Order
Faster than the Millennium Falcon making the jump to light speed, X users capitalized on the exposed information. An account holder named Enderman posted screenshots of interactions with Lego's customer service chatbot on its website, where the user seemingly managed to get the system to cancel Musk's order using the provided email and order number.
Within a couple of hours, Musk replied and stated that his order had not been canceled after all, potentially to check if the scheme had succeeded. Even so, the vulnerability of the public post soon became even more apparent.
Altering Quantities and Addresses
Another X user went back to Lego's AI assistant, known as Sophia, and supposedly used the exact same details to reopen the delivery. This time, the user succeeded in increasing the order count to 400 and changing the delivery address while utilizing Musk's original payment method.
Screenshots posted on social media captured the AI assistant replying, 'Perfect! I'll get your Lego adventure back on track.' Lego declined to comment when contacted to confirm whether such activity actually occurred on the personal order.
Broader Concerns in Agentic Commerce
Days prior, Musk had suggested that Grok could make online purchases with a simple prompt, telling users they only needed to upload a picture of their credit card for the bot to search for deals and complete transactions. Other AI companies like Meta and OpenAI have similarly highlighted the utility of shopping agents.
However, these developments arrive alongside heightened warnings regarding fraud. Visa previously cautioned about security risks in agentic commerce, noting that malicious actors could build legitimate-looking sites to fool AI assistants and harvest payment data for unauthorized transactions.
Sources
- WIREDElon Musk Bragged About His Grok Lego Star Wars Haul. Then X Users Punked Him
Continue chronologically
Related entity coverage
Related stories
Grok Admits Its AI Odyssey Adaptation Is Not Accurate
Months after Elon Musk vowed that xAI would produce a historically accurate version of The Odyssey, the chatbot itself has admitted defeat.
Grok Releases First Seven Minutes of AI-Generated Odyssey
Grok has published the first seven minutes of its AI-generated Odyssey series, following months after Elon Musk initially declared the project.
SpaceX AI Business Surpasses Expectations in Third Quarter
SpaceX reports $14.6 billion in third-quarter revenue, driven by its growing artificial intelligence business and data center operations.
Elon Musk Pours Millions Into Midterms As Oversight Looms
Elon Musk contributes over $76 million to his personal political committee in October, fueling high-stakes midterms and intense political scrutiny.
