Elon Musk shared Grok Lego order details and X users tried to change it

In short: Elon Musk posted a screenshot about Grok buying Lego sets, and it appeared to expose order details that other X users then tried to use to cancel or change the order.

What happened

Elon Musk posted on X about using Grok, his AI chatbot, to order Lego Star Wars sets. In the post, he shared a screenshot that appeared to include sensitive details like a 10-digit order number, what he paid, billing and delivery addresses, an email address, and the last four digits of a credit card.

Soon after, other X users posted screenshots claiming they used the order number and email with Lego’s customer service chatbot. One user said they were able to cancel the order. Musk later replied that the order had not been canceled.

Another user claimed they used Lego’s chatbot, which they called “Sophia,” to reopen the delivery, change the delivery address, and increase the quantity to 400 sets. Lego declined to comment to WIRED on whether these specific actions happened, and it is not clear what safeguards, if any, stopped or reversed changes.

Why it matters

This is a simple example of why sharing screenshots can be risky, especially when they include purchase and payment clues. It also highlights a broader concern with AI helpers that can shop for you, which is sometimes called an AI agent (like a personal assistant that can click buttons and place orders). Visa has warned that criminals can trick shopping bots into buying from fake stores or leaking payment data, and it reported increases in malicious bot-led transactions in 2025.

Source: Wired