The Oof Moment
Elon Musk just learned a masterclass in why you shouldn't share receipts on the timeline—especially when they're loaded with your personal data. After flexing on X about how his Grok AI agent successfully bought him some Lego Star Wars kits, he posted a screenshot. The problem? He forgot to blur out his delivery address, billing address, email, and the last four digits of his credit card.
The Internet Does Its Thing
Naturally, the internet didn't miss a beat. An X user named Enderman decided to test the security of Lego’s customer service chatbot by using the leaked info to cancel the billionaire's order. Musk later claimed the order wasn't actually canceled, but the chaos didn't stop there. Another user managed to get into the system and allegedly bumped the order up to 400 sets, rerouting the delivery and charging the original card.
Why it matters
This whole situation is a massive red flag for the future of "agentic commerce." While Musk was out here acting like letting an AI use a photo of your credit card to go shopping is the next big thing, security experts are sweating. Visa has already warned that bad actors are setting up fake sites specifically to bait these AI agents into handing over payment data. If you’re thinking about letting your chatbot hold your wallet, maybe hold that thought. Real talk: convenience is cool, but having your card data harvested by a malicious bot because you wanted a Lego set? That’s a major L.
