Published: October 11, 2026 · Last updated: October 11, 2026
TL;DR: Musk says you can skip the checkout page entirely: snap a pic of your card, hand it to Grok, and let the bot go bargain hunting with your actual payment info. Security folks are, understandably, not thrilled.
Elon Musk posted a shopping tip on X this week that reads less like a product announcement and more like the kind of message your bank’s fraud department warns you about. The pitch: stop typing your card number into checkout forms. Just photograph the card and hand it to a chatbot.
Musk described the feature as part of X’s Grok assistant, which users can summon in a chat as “@Bot.” According to Musk, you take a picture of your credit card, drop it into the conversation, and Grok goes out and finds you the best deal on whatever you’re trying to buy. Then it orders the item. No tabs, no comparison shopping, no typing your billing address for the fortieth time this year.
Here’s exactly how he put it.
“To buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok @Bot will scour the Internet for the best deal on the item you want and order it,” said Elon Musk, in a post on X.
Take a second with that sentence. He is describing, in plain language, sending a photo of an unredacted payment card to an AI chatbot and trusting it to place real orders on your behalf. That’s the whole mechanism, at least as far as Musk has explained it publicly.
The reaction arrived fast, and it was not kind. Outlets covering the post, including Stork.ai, immediately started asking the obvious questions. What happens to that photo after Grok reads it? Is the card number stored somewhere, or processed and discarded? Does X have some kind of tokenized or vaulted payment system sitting behind this, the same approach Apple Pay or Google Pay use to avoid ever exposing your raw card number to a merchant? Or is Grok just doing optical character recognition on your card and holding onto the digits like any other text in the chat log?
Nobody outside X seems to know, and Musk’s post doesn’t say. French outlet Cointribune framed its coverage of the announcement explicitly around the backlash it sparked, which tells you something about how this landed even among people inclined to take Musk’s product announcements seriously.
I’ll say what a lot of security researchers are clearly thinking without saying it quite this bluntly: handing a chatbot a photo of your real credit card is a terrible habit to build, regardless of how good Grok turns out to be at finding deals. Credit card numbers get phished, screenshotted, cached, and leaked in breaches often enough already without voluntarily feeding one into a large language model’s chat history. If this is secured with proper tokenization under the hood, great, but that’s not what Musk described. He described taking a picture of a card and dropping it in a chat.
To be fair, Musk didn’t commit to a date for this rolling out broadly. He’s describing a capability, not confirming a public launch with a timeline attached. That matters, because there’s a real difference between “here’s a feature we’re building” and “here’s a feature live for 600 million users right now.” As of this writing, it’s the former.
Still, the ambition here fits a pattern. X and xAI have been racing to turn Grok into something closer to a full assistant that can act in the world rather than just answer questions, and autonomous purchasing is an obvious next step if you’re trying to compete with agentic shopping tools from OpenAI, Google, and others. The problem is that “obvious next step” and “obviously secure” are not the same thing, and right now only one of those has been demonstrated.
Related: Coinbase Is Betting AI Agents Will Be the Next Big Users of Stablecoins and HubSpot Cuts 660 Jobs as It Restructures Around AI, and Its CEO Insists That’s Not Why.
Bottom Line: Musk wants Grok to shop for you using a photo of your actual credit card, and he hasn’t said anything publicly about how, or whether, that data gets secured. Until X explains the plumbing, treat this as a neat idea with a gaping question mark where the fraud protection should be.
Follow Teck Hustlers: Facebook · X · Instagram · LinkedIn · TikTok · Pinterest
