A Simple Task for an AI
Over the weekend, Elon Musk took to his social media platform, X, to showcase the real-world capabilities of Grok, the AI developed by his company xAI. He posted that he had tasked the AI with a straightforward mission: "I just asked Grok @Bot to research
the most fun Lego Star Wars kits for young kids and order them. As easy as that," he wrote. To prove its success, he shared a screenshot of the completed Lego website order, totalling $241.34 for five sets. The post was meant to highlight how Grok can function as a practical, agentic AI, capable of completing multi-step tasks like research and purchasing. However, the demonstration quickly became a case study in operational security.
An Unintended Privacy Lesson
In his haste to show off Grok's skills, Musk's screenshot left more than just the Lego order details visible to his 240 million followers. The unredacted image revealed two Texas addresses (a shipping and a billing address), an order number, an email address, and the last four digits of the American Express card used for the purchase. Social media users immediately spotted the exposed data. Musk later clarified that the address was not his residence but a mail-receiving location for his security team. The incident nonetheless highlighted significant security risks, with at least one YouTuber claiming they attempted to cancel the order using the leaked information.
The Controversial Credit Card Pitch
The Lego incident was only the beginning. Musk followed up by promoting a far more controversial feature. "To buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok @Bot will scour the Internet for the best deal on the item you want and order it," he posted on October 10. This suggestion was met with immediate and widespread backlash. Critics and security experts pointed out the immense privacy and financial risks of uploading sensitive financial data directly into an AI chat. The reaction was so swift that X's own Community Notes feature added context to Musk's post, warning that xAI's own policies advise against sharing personal information and that user data may be stored and subject to human review for financial transactions.
Grok's Role in the 'Everything App'
This push for AI-driven shopping is a key part of Musk's larger ambition to transform X into an 'everything app'. The vision is a single platform that integrates social media, messaging, news, and financial services, much like China's WeChat. Grok, which has real-time access to data on X, is central to this strategy. By handling tasks from content summarization to online shopping, Grok is being positioned as the intelligent layer that will connect all these disparate functions. However, a move into payments and financial data requires a level of user trust that is notoriously difficult to build, especially for a platform that has faced lawsuits over its handling of user data in the past.
A Question of Trust
The flak directed at the credit card idea underscores a fundamental challenge for Musk's vision. While the convenience of an AI that can shop for you is clear, the security implications are significant. Established payment systems already have protocols in place, such as requiring user approval for each purchase amount. Musk's casual suggestion to simply 'drop' a photo of a credit card into a chat left many questions unanswered about how the data would be stored, protected, and used. Even Grok itself, when asked about the safety of the idea, reportedly advised a user not to upload an actual credit card photo, highlighting the gap between Musk's bold proclamations and the practical realities of digital security.
