Elon Musk told X users to take a picture of their credit card and drop it into the chat to shop with Grok Bot, xAI’s errand-running agent. Some replies to the thread asked Grok to use Musk’s card instead of the users’ own cards.
Grok’s caution and the bot’s response
When someone asked whether Musk’s tip was “totally safe or stupid and dangerous,” Grok itself replied “neither” and warned users not to post a real card. In other words, the agent did not endorse posting actual card images without reservation.
Payments flow through a Stripe wallet
According to the available information, Grok Bot’s checkout process runs through a Stripe wallet. Stripe says this setup prevents the agent from seeing raw card numbers, creating a technical separation between the conversational agent and sensitive payment data.
Musk’s demonstration and its implications
The next day, Elon Musk posted a screenshot showing Grok ordering him five LEGO Star Wars sets; the screenshot appeared to include his billing details. By sharing his own billing page as proof that the system works, Musk effectively exposed his payment information in a public demonstration.
That action raises practical concerns: while the Stripe wallet is meant to limit the agent’s access to card data, publicly posting billing details can introduce new security risks and provides a stark example for fraud-prevention teams at banks and payment processors.
Why this matters
The episode highlights the trust question around autonomous shopping agents: users must rely on the agent and underlying payment infrastructure to handle financial data responsibly. Musk’s public encouragement suggested he had strong confidence in Grok — more than other users or possibly more than the agent itself expressed. Technical safeguards like Stripe wallets reduce exposure, but they do not replace cautious user behavior and robust operational security.
Summary
Elon Musk publicly urged X users to share credit card photos with Grok Bot for shopping. Grok cautioned against posting real cards and the checkout uses a Stripe wallet so the agent allegedly does not see card numbers, yet Musk followed up by posting a screenshot that seemed to show his own billing information, raising further data‑security questions.
