Musk asks followers to share credit card info

Elon Musk asked his 240 million Twitter followers to send photos of their credit cards to his AI, Grok Bot, to demonstrate its ability to make online purchases. This request came despite warnings from SpaceXAI about the risks of sharing personal data with the AI.

Musk shares example of AI placing order

On October 10, 2026, Musk tweeted a recipe for using Grok Bot to find the best prices and place orders. The next day, he shared a screenshot showing a Lego Star Wars order placed by the AI, which included personal details like a 10-digit order number, delivery and billing addresses in Texas, an associated email, and the last four digits of an American Express card.

Musk defends exposed personal data

Musk claimed the order was still active and that the exposed address was used by his security team to receive mail. According to Lego’s terms of service, once an order reaches the "In warehouse" status, it becomes non-cancelable online, which was the stage shown in the screenshot.

Exposed data used to alter order

Some internet users used the exposed data to cancel the order or change it, including increasing the quantity to 400 copies and altering the delivery address to "Little St James," a location linked to Jeffrey Epstein. This raised concerns about the misuse of personal information shared with the AI.

Privacy policy changes spark concern

The privacy policy from August 24 explicitly warned against including personal data in requests. However, the updated version from October 11 removed this instruction, placing the responsibility on the customer. This change contrasts with Musk’s earlier promise on August 26 that he would compensate users if Grok Bot made a mistake.

Musk's advice contradicts security guidelines

Musk had previously encouraged users to send photos of their credit cards to Grok Bot to simplify online shopping, contradicting the AI’s own advice and security recommendations from banks. Reports indicate that scams could exploit this flaw by using fake websites to recover shared credit card data, with Visa noting a 25% increase in malicious bot transactions in the second half of 2025.