Elon Musk Bragged About His Grok Lego Star Wars Haul. Then X Users Punked Him

There’s been a disturbance in the force. Only it’s more like a farce. It seems that Elon Musk, while crowing on X about how useful his Grok Bot AI agent was in ordering some Lego Star Wars kits on Sunday, managed to reveal via a screenshot to his more than 240 million followers not only the 10-digit Lego order number of his purchase, but also what he paid for the sets, the delivery and billing addresses, the last four digits of his credit card, and the email address his bot used to buy the bricks from Lego.

原力出现了一阵波动，但这更像是一场闹剧。埃隆·马斯克周日在 X 上吹嘘他的 Grok Bot AI 助手在订购乐高星球大战套装时有多么好用，却通过一张截图向他超过 2.4 亿的粉丝泄露了关键信息：不仅包括他购买的 10 位数乐高订单号，还有他支付的金额、送货和账单地址、信用卡后四位，以及他的机器人用来购买乐高积木的电子邮箱地址。

Faster than the Millennium Falcon making the jump to light speed, the inevitable happened. An X account holder named Enderman posted screenshots of interactions with Lego’s customer service chatbot on its website, where the user seemingly managed—using the email and order number Musk kindly, but recklessly, provided—to get the system to cancel Musk’s order.

比千年隼号进入超光速还要快，不可避免的事情发生了。一位名为 Enderman 的 X 用户发布了与乐高官网客服聊天机器人的互动截图，该用户似乎利用马斯克“慷慨”但鲁莽提供的邮箱和订单号，成功让系统取消了马斯克的订单。

It’s a Trap! Within a couple of hours—possibly to see whether Enderman’s scheme was actually successful—Musk replied and said his order had not been canceled after all.

这是个陷阱！几个小时后，马斯克回复称他的订单并没有被取消，这可能是为了验证 Enderman 的计划是否真的成功了。

But by this point, the folly of posting the purchase details on his account must have been evident. For example, another X user went back to Lego’s AI assistant, called “Sophia,” and supposedly used the same details to reopen the delivery, this time increasing the order count to 400 and changing the delivery address, all while using Musk’s original payment method. “Perfect! I’ll get your Lego adventure back on track,” Sophia replied, according to screenshots posted on X.

但到了这一步，在账户上发布购买详情的愚蠢行为已经显而易见。例如，另一位 X 用户再次联系了乐高的 AI 助手“Sophia”，据称利用同样的信息重新开启了配送，这次将订单数量增加到了 400 套，并更改了送货地址，同时继续使用马斯克原本的支付方式。根据 X 上发布的截图，Sophia 回复道：“太棒了！我会让你的乐高冒险重回正轨。”

Upping the ante to 400 sets could be seen as conservative, as a glance at WIRED’s Spend Elon Musk’s Money tracker reveals that if you wanted to blow $1 trillion of Musk’s cash on plastic bricks, it might have been possible to buy one billion $1,000 Death Star sets, each with 9,023 pieces.

将订单增加到 400 套可能还算保守，因为查看《连线》杂志的“花掉埃隆·马斯克的钱”追踪器就会发现，如果你想把马斯克的 1 万亿美元现金花在塑料积木上，理论上可以买到 10 亿套价值 1000 美元的死星套装，每套包含 9023 个零件。

Lego declined to comment when WIRED contacted the company to confirm if such activity took place on Musk’s personal Star Wars order. However, internal safeguards for Lego’s AI assistant could have flagged unusual activity on the purchase, and so hopefully fleshy humans were tasked with checking the changes.

当《连线》联系乐高公司以确认马斯克的个人星球大战订单是否确实发生了此类活动时，乐高拒绝置评。不过，乐高 AI 助手的内部安全机制可能已经标记了该订单的异常活动，希望有真人工作人员负责核查这些更改。

Attack of the Clones. On Saturday, Musk suggested that Grok could make purchases online with a simple prompt. In this post, Musk suggested that all brave users needed to do to let Grok buy stuff for them was upload a picture of their credit card so the bot could search the web for deals and then complete the purchase. AI companies like Meta and OpenAI have also highlighted the utility of using their respective agents for shopping tasks.

克隆人的进攻。周六，马斯克表示 Grok 可以通过简单的提示在线购物。在这篇帖子中，马斯克建议，勇敢的用户只需上传信用卡照片，Grok 就能为他们搜索网络优惠并完成购买。Meta 和 OpenAI 等人工智能公司也强调了使用各自的智能体进行购物任务的实用性。

However, at the end of last year, Visa warned about fraud in agentic commerce, advising that bad actors were building legitimate-looking sites that could fool AI agents into purchasing fake items simply by offering gear at super-low prices.

然而，去年年底，Visa 对智能体商务中的欺诈行为发出了警告，指出不法分子正在建立看起来合法的网站，通过提供超低价商品来诱骗 AI 智能体购买假货。

“Once the AI agent completes the purchase … the malicious merchant can harvest payment data and instantly use it for unauthorized transactions,” according to Visa’s blog. Visa added that it observed a 25 percent increase “in malicious bot-initiated transactions” in the latter half of 2025, but in the US, this figure jumped to 40 percent.

Visa 的博客称：“一旦 AI 智能体完成购买……恶意商家就可以获取支付数据，并立即将其用于未经授权的交易。”Visa 还补充说，他们在 2025 年下半年观察到“恶意机器人发起的交易”增加了 25%，而在美国，这一数字跃升至 40%。