Elon Musk brags about his LEGO Groke Star Wars game. X users then punked him

Musk, we find your lack of security annoying.

A power failure has occurred. It's just more like a farce.

As Elon Musk gushed about X how helpful his Grok Bot AI agent was in ordering some Star Wars Lego kits on Sunday, Elon Musk appears to reveal to his more than 240 million followers not only the 10-digit number of his Lego purchase, but also the amount he paid for the sets, his delivery and credit card address, and the email address of his last purchase. Lego bricks.

Faster than the Millennium Falcon making the leap to the speed of light, the inevitable happened. An X account holder named Anderman posted screenshots of an interaction with a Lego customer service chatbot on his website, where the user apparently managed to politely, but recklessly, get the system to cancel the mask order by using the mask's email and order number.

Musk responded within hours—presumably to see if Enderman's plan had actually succeeded—and said his order had not been canceled.

But by this point, the folly of including the purchase details in his account should have been obvious. For example, another user X went to Lego's AI assistant, Sophia, and apparently used the same details to reopen a delivery, this time increasing the number of orders to 400 and changing the delivery address, all while using Mask's original payment method. "Awesome! I'll get your Lego adventure back on track," Sophia replied, referring to the screenshots. Posted in X.

Raising the level to 400 sets seems conservative, as a quick glance at WIRED's Spend Elon Musk's Money shows that if you wanted to buy $1 trillion of Musk's cash on plastic bricks, you might as well buy $1 billion Death Star sets, 9.0 pieces each.

Lego declined to comment when WIRED contacted the company to confirm whether such activity was personally commissioned by the Star Wars mask. However, Lego's AI assistant's built-in safeguards could have flagged unusual shopping activity, and so it's hoped that flesh-and-blood humans will be tasked with checking for changes.

On Saturday, Musk suggested that Grok could make online purchases with a simple request. In the post, Musk suggested that all brave users have to do to let Grok buy things for them is upload a picture of their credit card so the bot can search the web for deals and then complete the purchase. AI companies such as Meta and OpenAI have also highlighted the usefulness of using their respective agents for procurement tasks.

However, at the end of last year, Visa warned about fraud in the dealer business, advising that bad actors were building legitimate-looking sites that could trick AI agents into buying fake items simply by offering them at very low prices.

According to Visa's blog, "Once the AI agent completes the purchase ... the malicious merchant can collect the payment data and immediately use it for unauthorized transactions." Visa added that it sees a 25 percent increase in "malicious bot-initiated transactions" in the second half of 2025, but in the United States, that number rises to 40 percent.