An image Elon Musk shared while demonstrating Grok's online shopping tools was later found to include personal data, prompting a wave of criticism across social media. Visible within the post on X were an email address, billing and shipping details, and a fragment of payment data.
The screenshot Musk shared on X came alongside a demonstration of how his AI chatbot handles product searches and purchases with limited user input. The demonstration drew attention to data privacy and digital security considerations tied to AI-powered shopping tools, alongside questions about their convenience.
Five Star Wars-branded Lego sets changed hands in the transaction, carrying a combined price tag of around $241.34, or roughly £182.26. Framing the post as a demonstration of Grok's ability to handle shopping requests on behalf of users, Musk shared a screenshot that onlookers noted appeared to contain details he had not planned to disclose.
Musk described directing Grok toward finding age-appropriate Lego sets and completing the purchase on his behalf. The chatbot was built to handle both product research and the checkout steps on a user's behalf, removing the need to navigate between multiple sites.
A photograph accompanying the post contained information that extended beyond what the payment record alone disclosed. Among the details visible on screen were a shipping destination in Austin, Texas, a distinct billing address, an email contact, an order reference number, and the closing four digits of an American Express card.
That content reached Musk's account on X, a platform where his follower count stands at over 240 million. The episode drew attention from those who raised questions about why a person advocating for an AI-driven retail tool had posted an image containing private data belonging to others.
In a follow-up statement, Musk noted that the address made public was tied to his postal deliveries, not the property where he actually lives. Questions about what it means for personal data belonging to one of the world's most prominent executives to be accessible to anyone kept the episode under sustained examination.
Responses from viewers and commenters were largely dismissive, with a notable portion raising doubts about the rationale behind it. One account focused on digital security framed the concern as a home address paired with transaction details, broadcast to an audience numbering in the hundreds of millions.
Some readers raised doubts about entrusting an AI tool with personal financial data, pointing to a public post in which the product's leading advocate appeared to have left their own details exposed. Objections extended beyond the immediate product to address what AI-powered shopping tools might mean at a broader level.
Streamlining purchases through automation offers a time-saving appeal, yet the technology brings with it questions about how data — from payment credentials to browsing and buying records — gets collected, stored, and used. Musk has been promoting Grok's capacity to look up pricing and handle product purchases on a user's behalf, a backdrop against which the episode unfolded.
Posting credit-card photographs to the chatbot was something he put forward as a way for the tool to handle shopping tasks on a user's behalf. AI tools are increasingly being built to carry out tasks on a user's behalf, moving beyond the role of simply providing answers. Handling purchases, processing payments, and stepping into workflows that once depended on direct human involvement are all within the reach of these platforms.
Extending AI tool access to data classed as sensitive opens the door to a broader set of vulnerabilities. Questions about what an automated purchasing tool gathers on users, how that information travels through its infrastructure, and what safeguards govern it have been raised in the context of organisations granting procurement authority to such systems.
