Musk’s Grok Lego Order Screenshot Exposed Payment Details, Prompting Users to Manipulate Purchase
After Elon Musk shared a screenshot of an AI-driven Lego purchase, X users used the exposed data to attempt changes to the order, highlighting risks of oversharing.
Key points
- Musk posted a screenshot revealing his Lego order number, payment details, and addresses.
- An X user named Enderman used the data to attempt to cancel the order via Lego's chatbot.
- Another user allegedly used the same details to increase the order quantity and change the address.
Elon Musk exposed sensitive personal and financial data on X on Sunday after posting a screenshot of a Lego Star Wars purchase made by his Grok AI agent. The image, visible to his more than 240 million followers, included his order number, payment information, and delivery details, according to Wired.
The post revealed the last four digits of his credit card, the email address used for the transaction, and the full delivery and billing addresses. Musk had previously suggested on Saturday that users could allow Grok to make online purchases by uploading a picture of their credit card to search for deals and complete transactions.
Context and Background
Within hours of the post, an X account holder named Enderman posted screenshots showing interactions with Lego's customer service chatbot on the company's website. According to Wired, Enderman used the email address and order number provided by Musk to request a cancellation of the order. The user claimed to have successfully navigated the system to initiate this change using the publicly shared credentials.
Musk responded within a couple of hours, stating that his order had not been canceled. His reply suggested he was checking the status of the purchase after Enderman’s attempt. This response confirmed that the initial cancellation attempt did not result in the order being voided, though the exposure of his data remained a significant security concern.
Who is Affected
Following Musk’s confirmation that the order was still active, another X user reportedly interacted with Lego’s AI assistant, named Sophia. According to screenshots posted on X, this user used Musk’s original payment method and order details to supposedly reopen the delivery process. The user allegedly increased the order count to 400 sets and changed the delivery address, actions that were reportedly processed by the chatbot.
Lego declined to comment when Wired contacted the company to confirm if such activity occurred on Musk’s personal order. However, Wired noted that internal safeguards for Lego's AI assistant might have flagged unusual activity, potentially leading to human review of the changes. The incident underscores the risks associated with sharing detailed transaction screenshots on public social media platforms.
What should you do?
Security professionals should monitor for similar incidents where high-profile individuals or organizations share sensitive transaction data. Users should be advised against posting screenshots of orders, receipts, or payment confirmations that contain personally identifiable information. Organizations using AI agents for purchases should implement strict access controls and verification steps to prevent unauthorized modifications.
What to do and how to stay safe: Elon Musk
- Avoid posting screenshots of online orders, receipts, or payment confirmations on social media, as they often contain sensitive data like order numbers and partial payment details.
- Enable two-factor authentication on all accounts linked to financial transactions to add an extra layer of security against unauthorized access.
- Monitor your financial statements and order histories regularly for any unauthorized changes or purchases, especially after sharing any transaction details publicly.
- Be cautious when using AI agents for online purchases; ensure you understand the security implications and have robust safeguards in place to prevent misuse of your credentials.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific information did Elon Musk expose in his X post?
Musk exposed his 10-digit Lego order number, the last four digits of his credit card, his email address, and his delivery and billing addresses.
Did the users successfully cancel or modify Musk's Lego order?
Musk stated his order was not canceled. Another user allegedly attempted to increase the quantity and change the address, but Lego did not confirm if these changes were processed.
Did Lego comment on the incident?
No, Lego declined to comment when Wired contacted the company to confirm if such activity took place on Musk's personal Star Wars order.
