Elon Musk decided to share a post on X celebrating how helpful his Grok Bot AI agent was in ordering some Lego Star Wars kits. In doing so, he posted a screenshot visible to his massive follower base that inadvertently revealed not just the ten-digit Lego order number, but also the exact pricing, delivery and billing addresses, the final four digits of his credit card, and the specific email address utilized by the bot to secure the bricks.
Swift reactions followed on the platform. An account holder known as Enderman posted images showing interactions with the customer service chatbot on the official Lego website, where the user seemingly managed to leverage the exposed email and order number to get the system to cancel Musk's transaction altogether.
A couple of hours later, likely seeking to verify whether the cancellation scheme actually worked, Musk responded publicly to state that his purchase had not been called off after all.
Despite that reassurance, the security oversight of broadcasting sensitive purchase parameters was glaring. Another X user returned to the Lego AI assistant, designated as Sophia, and reportedly used those exact credentials to reactivate the delivery process, bumping the order quantity up to 40
