One screenshot, too much data

Elon Musk bragged on Sunday about Grok, xAI's AI agent, ordering Star Wars LEGO sets for him. The screenshot he shared with more than 240 million followers exposed a ten-digit order number, the amount paid, billing and shipping addresses, the last four digits of the credit card, and the email address the bot used to complete the purchase on LEGO's site. That kind of personally identifiable information (PII) leak — in the context of an autonomous agent — is a scenario the technical community has warned about for months. Here it played out in real time, courtesy of the platform's owner himself.

The LEGO bot played along

Within hours, an X user known as Enderman posted screenshots of a conversation with LEGO's chatbot, "Sophia." Using the email and order number Musk had voluntarily supplied, the user apparently coaxed the system into canceling the original order. Musk later replied that the order wasn't ultimately canceled, but the damage was done: another user demonstrated how the same details could reopen the shipment, increase the quantity to 400 sets, and change the destination address — all using Musk's original payment method. LEGO declined to comment on WIRED's inquiry; internal safeguards may have flagged the anomalous activity and escalated it for human review.

The promise that preceded the glitch

A day earlier, Musk had suggested Grok could soon make web purchases on a simple command: users would just upload a photo of their credit card, and the bot would hunt for deals and complete the checkout. The idea of autonomous shopping agents isn't new — Meta and OpenAI have shown similar capabilities — but Musk's demo illustrated exactly the attack vector researchers have flagged: exposing payment credentials to a language model operating without adequate guardrails.

Visa spots a worrying trend

Late last year, Visa issued a warning about fraud in agentic commerce. According to the company's official blog, attackers are building legitimate-looking sites that lure AI agents into buying counterfeit items at suspiciously low prices; once the agent completes the transaction, the payment details are stolen and immediately used for unauthorized purchases. Visa reported a 25% rise in malicious bot-initiated transactions in the second half of 2025, with the U.S. seeing a 40% jump. Those numbers frame the Musk incident not as a one-off joke but as a live illustration of a systemic risk that is scaling fast.

When the agent becomes the weak link

The episode lays bare the gap between the marketing promise — "let the bot buy for you" — and the technical reality: large language models (LLM) aren't built for identity management, permissions, or payment controls. When an agent gets unfettered access to payment instruments and operates against interfaces designed for humans (customer-service chatbots), any leak of order identifiers or card details becomes a weapon for anyone who knows how to manipulate the system. Until standards like verified digital identity and agent-level transaction authorization become the norm, every innocent screenshot is an open invitation to abuse.