Grok Lego Order Leak Exposes PII and Order Number to 240 Million Followers

Elon Musk shared a screenshot on X on Sunday showing his Grok AI agent purchasing Lego Star Wars kits. The image displayed his delivery and billing addresses, the last four digits of his credit card, the associated email address, and a ten-digit order number. According to Wired, this public disclosure exposed sensitive Personally Identifiable Information (PII) to his audience of more than 240 million users, creating an immediate security exposure.

The risk

An X user identified as Enderman used the exposed order number and email address to contact Lego’s customer service chatbot. Wired reports that the user seemingly managed to get the system to cancel Musk’s order. This incident demonstrates how publicly shared order confirmations can serve as valid authentication credentials for customer support portals, bypassing traditional security controls.

Who is exposed

Musk was the primary victim of this exposure, having voluntarily published his financial and personal data. However, the incident highlights risks for any user who shares order confirmations or uses AI agents to conduct e-commerce transactions. According to Wired, another user reportedly used the same details to reopen the delivery, increase the quantity to 400 sets, and change the address, though Lego has not confirmed these actions were finalized.

Cost and compliance

Lego declined to comment to Wired regarding whether the unauthorized modifications were actually processed on Musk’s account. The company did not confirm if such activity occurred. Internal safeguards for Lego’s AI assistant, named Sophia, may have flagged the unusual volume of changes. Wired noted that hopefully fleshy humans were tasked with checking the changes, suggesting automated systems may lack sufficient context for high-value or anomalous requests.

What should you do?

Security teams should audit social media policies to prevent employees from sharing order confirmations or payment details publicly. Organizations using AI agents for procurement should enforce strict output filtering to redact sensitive data before any external sharing. Managers must verify that customer service APIs require multi-factor authentication rather than relying solely on order numbers and email addresses.

Background: AI agents

AI agents are software systems that perceive their environment, make decisions, and execute actions to achieve specific goals. Unlike standard models, they maintain internal state and interact with external tools, creating unique security risks around tool execution, memory retention, and autonomous decision loops that require specialized controls.

Read the full guide: AI Agents Explained: Answers to Security and Architecture Questions

What to do and how to stay safe: Elon Musk

• Review internal social media guidelines to explicitly prohibit posting screenshots of order confirmations, invoices, or payment receipts.
• Implement data loss prevention tools that scan outgoing messages for patterns resembling credit card numbers or order IDs.
• Require multi-factor authentication for any customer service portal that allows order modification or cancellation.
• Monitor AI agent outputs for sensitive data leakage before they are published to public or semi-public channels.

Step-by-step guide: Mobile Security Architecture: 8 Practices for Device Integrity

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific data was exposed in the screenshot?

The screenshot revealed the order number, delivery and billing addresses, the last four digits of the credit card, and the email address used for the purchase.

Did the user successfully cancel Elon Musk’s Lego order?

Musk replied that his order was not canceled, though a user seemingly managed to prompt the chatbot to do so using the exposed details.

Did Lego confirm the order changes were processed?

Lego declined to comment to Wired and did not confirm whether the unauthorized modifications to the order were actually executed in their system.