Elon Musk wanted to show the world how smart his AI chatbot is. Instead, he showed 240 million followers where he gets his mail, what credit card he uses, and how much he spends on Lego.
Musk asked Grok Bot to find the most fun Star Wars Lego sets for young children and order them. The AI dutifully purchased five sets totaling $241.34 (approximately PKR 67,200).
Then Musk posted the unredacted checkout screenshot to X, complete with his Austin shipping address, a separate billing address, his email, an order number, and the last four digits of his American Express card.
I just asked Grok @Bot to research the most fun Lego Star Wars kits for young kids and order them. As easy as that. https://t.co/5IKVoqvuhb
— Elon Musk (@elonmusk) October 11, 2026
The internet did what the internet does. YouTuber Enderman claimed he used Musk’s exposed order number to request a cancellation through Lego’s customer service bot.
Musk responded by saying the address belongs to his security team and that it “has already been doxxed multiple times.” So that makes it fine, presumably.
But the Lego incident was only half the show. Musk also suggested that users photograph their credit cards and upload them to Grok for shopping. X’s own Community Notes promptly flagged this advice, noting that xAI “explicitly warns users not to include personal information in prompts.”
Under xAI’s privacy policy, uploaded content may stay retained for up to 30 days after deletion. The platform also could train future AI models on that. So yes, your credit card photo could technically become training data.
This marks at least the second time Musk has accidentally doxxed himself on X. In June 2025, he reportedly exposed personal details while sharing drug test results. Still, Grok Bot continues expanding its commerce features. In August 2026, the bot completed one of the first documented AI high-value purchases. The order was a Tesla Model Y for a user. That demo, at least, went without broadcasting anyone’s home address.