内容来源：https://www.wired.com/story/elon-musk-bragged-about-his-grok-lego-star-wars-haul-then-x-users-punked-him/

内容总结：

一场“原力扰动”最终演变成了一出闹剧。埃隆·马斯克在社交平台X上炫耀其AI助手Grok帮他订购乐高星球大战套装时，因发布截图，不慎向2.4亿多粉丝泄露了订单号、支付金额、收发货地址、信用卡后四位以及用于购买的电子邮箱。

很快，一名叫Enderman的X用户利用这些信息，通过乐高官网的客服聊天机器人取消了马斯克的订单。马斯克随后回复称订单并未被取消，但此时事态的荒唐已显而易见：另一名用户据称用同样的信息重新下单，将数量改为400套，更改了收货地址，并沿用马斯克的支付方式。乐高方面拒绝就是否发生上述操作置评，但内部安全机制可能已标记异常活动。

马斯克此前曾建议用户上传信用卡照片即可让Grok代为购物。Meta和OpenAI等公司也推广过AI代理的购物功能。然而Visa去年底警告称，恶意商家可搭建看似合法的网站，以极低价格诱导AI代理购买假货，从而窃取支付数据。Visa观察到2025年下半年“恶意机器人发起的交易”增加了25%，在美国这一数字高达40%。

中文翻译：

原力出现了扰动。只不过更像是一场闹剧。

看起来，埃隆·马斯克周日在X上得意洋洋地炫耀他的Grok机器人AI代理帮他订购乐高星球大战套装有多么好用时，却通过一张截图向他超过2.4亿的粉丝泄露了他购买的10位乐高订单号，还泄露了他为这些套装支付的金额、送货和账单地址、信用卡后四位数字，以及他的机器人用来从乐高购买积木所用的电子邮箱地址。

比千年隼号跃入光速还快，不可避免的事发生了。一位名为Enderman的X用户发帖晒出了与乐高官网客服聊天机器人的互动截图，该用户似乎利用马斯克“好心”但草率提供的邮箱和订单号，成功让系统取消了马斯克的订单。

这是个陷阱！

几个小时内——可能是为了看看Enderman的计划是否真的得逞——马斯克回复称他的订单并没有被取消。

但到这时，把购买详情发在自己账号上的愚蠢之处想必已经一目了然。例如，另一位X用户又去找了乐高的AI助手“Sophia”，据称用同样的信息重新开启了配送，这次把订单数量加到了400套，还更改了送货地址，同时仍然使用马斯克原来的付款方式。根据发布在X上的截图，Sophia回复道：“太好了！我会让你的乐高冒险重回正轨。”

把订单加到400套可能还算保守的，因为看一眼《连线》杂志的“花掉埃隆·马斯克的钱”追踪器就会发现，如果你想在塑料积木上挥霍马斯克10亿美元，大概可以买10亿套每套1000美元、含9023块零件的死星套装。

《连线》联系乐高求证马斯克的个人星球大战订单上是否确实发生了此类操作，乐高拒绝置评。不过，乐高AI助手的内部安全机制本应标记出这笔购买中的异常活动，所以但愿有血有肉的人类被派去核查了这些改动。

克隆人的进攻

周六，马斯克表示Grok可以通过一句简单的指令在网上购物。在这条帖子中，马斯克表示，勇敢的用户只需上传一张信用卡照片，就能让Grok替他们买东西，机器人可以上网搜索优惠，然后完成购买。Meta和OpenAI等AI公司也强调了使用各自代理进行购物任务的实用性。

然而，去年年底，Visa就代理式商务中的欺诈行为发出警告，指出不法分子正在搭建看起来合法的网站，只需以超低价格提供商品，就能骗过AI代理购买假货。

Visa的博客文章称：“一旦AI代理完成购买……恶意商家就可以收集支付数据，并立即用于未授权交易。”Visa还补充说，他们在2025年下半年观察到“恶意机器人发起的交易”增加了25%，但在美国，这一数字跃升至40%。

评论

回到顶部

英文来源：

There's been a disturbance in the force. Only it's more like a farce.
It seems that Elon Musk, while crowing on X about how useful his Grok Bot AI agent was in ordering some Lego Star Wars kits on Sunday, managed to reveal via a screenshot to his more than 240 million followers not only the 10-digit Lego order number of his purchase, but also what he paid for the sets, the delivery and billing addresses, the last four digits of his credit card, and the email address his bot used to buy the bricks from Lego.
Faster than the Millennium Falcon making the jump to light speed, the inevitable happened. An X account holder named Enderman posted screenshots of interactions with Lego's customer service chatbot on its website, where the user seemingly managed—using the email and order number Musk kindly, but recklessly, provided—to get the system to cancel Musk's order.
It’s a Trap!
Within a couple of hours—possibly to see whether Enderman's scheme was actually successful—Musk replied and said his order had not been canceled after all.
But by this point, the folly of posting the purchase details on his account must have been evident. For example, another X user went back to Lego's AI assistant, called “Sophia,” and supposedly used the same details to reopen the delivery, this time increasing the order count to 400 and changing the delivery address, all while using Musk's original payment method. “Perfect! I'll get your Lego adventure back on track,” Sophia replied, according to screenshots posted on X.
Upping the ante to 400 sets could be seen as conservative, as a glance at WIRED's Spend Elon Musk’s Money tracker reveals that if you wanted to blow $1 trillion of Musk's cash on plastic bricks, it might have been possible to buy one billion $1,000 Death Star sets, each with 9,023 pieces.
Lego declined to comment when WIRED contacted the company to confirm if such activity took place on Musk's personal Star Wars order. However, internal safeguards for Lego's AI assistant could have flagged unusual activity on the purchase, and so hopefully fleshy humans were tasked with checking the changes.
Attack of the Clones
On Saturday, Musk suggested that Grok could make purchases online with a simple prompt. In this post, Musk suggested that all brave users needed to do to let Grok buy stuff for them was upload a picture of their credit card so the bot could search the web for deals and then complete the purchase. AI companies like Meta and OpenAI have also highlighted the utility of using their respective agents for shopping tasks.
However, at the end of last year, Visa warned about fraud in agentic commerce, advising that bad actors were building legitimate-looking sites that could fool AI agents into purchasing fake items simply by offering gear at super-low prices.
“Once the AI agent completes the purchase … the malicious merchant can harvest payment data and instantly use it for unauthorized transactions,” according to Visa's blog. Visa added that it observed a 25 percent increase “in malicious bot-initiated transactions” in the latter half of 2025, but in the US, this figure jumped to 40 percent.
Comments
Back to top