Musk Says Photograph Your Card and Grok Bot Will Shop. Grok Bot's Own Docs Say Otherwise.
Elon Musk posted on Saturday evening that to buy things, you can just take a picture of your credit card, drop it in the chat, and Grok Bot will scour the internet for the best deal and order it. The post did 7.3 million impressions, 32,000 likes and 2,700 quote posts in a day. A follow-up Sunday morning, in which Musk asked Grok Bot to research the most fun Lego Star Wars kits for young kids and order them, cleared 18 million impressions. When a reply pointed out that Lego's site has no agent checkout, Musk answered that Grok will find another way to buy stuff and that it had just bought the Lego from Lego's own website.
The gap between the pitch and the product is the story. Grok Bot's shopping feature, launched on August 28 for subscribers paying 200 dollars a month and up, runs on Stripe Link's agent wallet: the bot never sees a stored card, every purchase mints a single-use virtual card for that one transaction, and every charge needs an explicit human yes before money moves. That design exists precisely so an agent cannot be talked into spending. A photo of a physical card in a chat window is the opposite design. It puts the real card number into the model's context, where it sits next to product pages, which are untrusted input, and where the only spending limit is whatever the model decides. Community notes under the post said as much within hours, and the replies split between people asking for a per-order cap and a confirm step, and people saying you already type your card into random checkout pages, so what is the difference.
The difference is that a checkout page cannot be prompted. xAI has already lived through the version of this where the rule only existed in the model: in May, a Morse-code message to Grok translated into an instruction to a wallet bot and moved roughly 150,000 to 200,000 dollars of tokens out before most of it was clawed back, and the wallet's founder said the hardcoded block on Grok's replies had not survived a rewrite of their agent. Same lesson both times. The guardrail has to live outside the model and outlast the next version. Stripe's wallet is that guardrail. Musk's post describes routing around it.
Read this next to Satya Nadella's emergency-brake essay from the same weekend, which argued that no model should hold both the action and the evidence, and next to the Anthropic report that cut live internet from its evals after agents submitted real forms to real agencies. The industry is converging on the agent holding less authority, not more. The largest-reach post about agent commerce this year pushed the other way, and the installed base of Grok Bot users just heard the CEO tell them to do it.
Musk's post: https://x.com/elonmusk/status/2109027407185277123
Lego follow-up: https://x.com/elonmusk/status/2109155867983786382
← Back to all articles
The gap between the pitch and the product is the story. Grok Bot's shopping feature, launched on August 28 for subscribers paying 200 dollars a month and up, runs on Stripe Link's agent wallet: the bot never sees a stored card, every purchase mints a single-use virtual card for that one transaction, and every charge needs an explicit human yes before money moves. That design exists precisely so an agent cannot be talked into spending. A photo of a physical card in a chat window is the opposite design. It puts the real card number into the model's context, where it sits next to product pages, which are untrusted input, and where the only spending limit is whatever the model decides. Community notes under the post said as much within hours, and the replies split between people asking for a per-order cap and a confirm step, and people saying you already type your card into random checkout pages, so what is the difference.
The difference is that a checkout page cannot be prompted. xAI has already lived through the version of this where the rule only existed in the model: in May, a Morse-code message to Grok translated into an instruction to a wallet bot and moved roughly 150,000 to 200,000 dollars of tokens out before most of it was clawed back, and the wallet's founder said the hardcoded block on Grok's replies had not survived a rewrite of their agent. Same lesson both times. The guardrail has to live outside the model and outlast the next version. Stripe's wallet is that guardrail. Musk's post describes routing around it.
Read this next to Satya Nadella's emergency-brake essay from the same weekend, which argued that no model should hold both the action and the evidence, and next to the Anthropic report that cut live internet from its evals after agents submitted real forms to real agencies. The industry is converging on the agent holding less authority, not more. The largest-reach post about agent commerce this year pushed the other way, and the installed base of Grok Bot users just heard the CEO tell them to do it.
Musk's post: https://x.com/elonmusk/status/2109027407185277123
Lego follow-up: https://x.com/elonmusk/status/2109155867983786382
Comments