Posting an order confirmation to prove your AI can shop is a reasonable demonstration, until that screenshot contains enough detail for strangers to attempt interfering with the purchase. That is what happened when Elon Musk shared proof that Grok had researched and ordered Lego Star Wars sets on his behalf, turning a product demo into a live stress test of retail customer-service security. The post sparked an immediate privacy controversy that underscored how quickly visible order data can be exploited.
What Happened
Musk’s Grok demo produced a real order confirmation, and the screenshot handed out the details.
Musk posted on X that Grok had researched “the most fun Lego Star Wars kits for young kids” and placed an order covering five sets totaling $241.34, charged to an American Express card. The order confirmation screenshot appeared to show a 10-digit order number, shipping and billing addresses, an email address, and the last four digits of the payment card.
Musk later clarified that the visible address belonged to his security team or mail reception rather than his personal residence. That detail narrowed the personal exposure, but it did not change what was visible to anyone who saw the post.
An X user identified as Enderman posted screenshots purportedly showing an attempt to cancel the order through Lego’s customer-service chatbot, claiming “Just canceled your order.” Musk subsequently said the order was not canceled, and no independent reporting confirmed the attempt succeeded.
Other unverified screenshots circulated showing Lego’s “Sophia” assistant apparently accepting requests to reopen the order, increase the quantity to 400 sets, and modify delivery details. Lego declined to comment to WIRED on whether any of that activity affected the actual order.
Why the Exposure Happened
The information was public because Musk posted it, not because any system was breached.
Nothing about this incident required sophisticated technical intrusion. No reporting reviewed for this story established a breach of Lego or Grok. The order details became public because they appeared in Musk’s own post, which is a meaningful distinction worth keeping clear.
The screenshot also did not establish that Grok completed every step of the purchase autonomously. Payment approval or some form of user action may still have been required during checkout.
What the incident did demonstrate is that agentic AI concentrates sensitive order data inside a single conversational flow. These systems can browse sites, make selections, and initiate transactions, but what happens to that data afterward depends entirely on human judgment about what to share.
If you are evaluating an AI shopping agent, the relevant question is not only whether it can place an order. It is whether every system it touches can verify who is actually authorizing changes afterward.
The Larger Security Context
Visa flagged a 25% spike in malicious bot transactions; the Lego episode shows the threat is sometimes far simpler.
Visa has warned that malicious merchants could construct legitimate-looking retail sites designed to deceive shopping agents into purchasing counterfeit or nonexistent products. The stated goal is to harvest payment credentials from the transaction.
Visa also reported a 25% increase in malicious bot-initiated transactions during the second half of 2025, with a 40% increase recorded in the United States.
The Musk incident illustrates a lower-tech version of the same underlying problem. A customer-service chatbot that reportedly accepts order-modification requests based on limited identifying information represents an authentication gap that has nothing to do with AI sophistication on the buyer’s side.
What Comes Next
Retailers will need stronger verification before AI agents can reliably handle the full transaction cycle.
Retailers will likely need stricter proof-of-control requirements before allowing any agent or chatbot to cancel orders, change delivery addresses, modify quantities, or reuse stored payment details. That means verifying identity before accepting any such request, regardless of whether the request comes from a human or an automated system.
Agentic commerce is genuinely useful, but its convenience only holds up when the systems on the receiving end are built to confirm who is actually making the request.
