Grok Bot can now shop and pay for you. Musk urged users to upload photos of their cards, but the demo screen itself reportedly showed an address and a card's last four digits

xAI has reportedly enabled its agent, Grok Bot, to shop and make payments (Ynetnews, 24/7 Wall St.). According to the reports, Elon Musk encouraged users on X to upload photos of their credit cards and hand them to Grok Bot. Yet the demo screen showing off the feature reportedly displayed a delivery address, an order number and a card's last four digits. All of this information comes from media reports. We have not been able to find official documentation from xAI, and we have not seen the image in the original post.

Even so, the problem this one image points to is clear. If an agent only searches for and compares products, a mistake costs the user nothing more than time. Once it is trusted with payment, the agent holds the means of payment itself. At that point, the biggest risk is no longer how smart the model is. It is how the agent receives credentials, where it stores them, and who it keeps them hidden from.

What was reported

Musk had already described Grok Bot as an agent that handles email, spreadsheets, customer support and coding. On October 7, he wrote that it routes each task to the best-suited model, including Anthropic's Claude Opus 5.5, Midjourney and Suno (per secondary sources). On October 9, he posted that Grok Bots would take over running Grokipedia. What was reported this time is that the agent's scope has expanded to moving users' money.

According to the reports, the method Musk recommended for adding a card was to upload a photo of it. The reports do not show any official explanation of which stores it works with, whether there is a per-transaction limit, or whether the user is asked to confirm before a payment goes through.

Three pieces of information on the demo screen

On its own, an address, an order number or a card's last four digits is not much of a secret. The last four digits are printed on receipts. Put the three together, though, and things change. They overlap heavily with what online retailers and card issuers use to verify identity over the phone or in chat. Someone who can recite an order number, an address and the last four digits is likely to look like the actual customer to a support agent. That opens the door to impersonation, such as requesting a return, changing a delivery address or recovering an account.

What makes this serious is that the information appeared in a promotional demo, not in a careless user's post. It means the company shipping the product had not decided what to hide before publishing its own screen. Screens generated by agents routinely show personal information such as order confirmations and delivery status. Decisions about what to display and what to mask need to be built into the default settings.

The problem with "upload a photo of your card"

A photo of a card shows far more than the last four digits. It shows the full card number and the expiration date. A photo of the back also shows the security code. Images uploaded in a conversation are normally saved as part of the chat history. They can also persist in an agent's memory (Agent Memory) or in traces kept for Agent Observability. Over many years, the payments industry has built ways for merchants to avoid holding full card numbers: tokenization, single-use numbers for each transaction, and spending limits set by card issuers. Pasting a photo of a card into a chat bypasses all of that work at the very first step.

The description of Grok Bot as routing each task to a different model matters here too. Are card images and order details handled only inside xAI's models, or can they also reach other companies' models that tasks are routed to? Neither Musk's posts nor the reports say anything about how the data is handled.

The same pattern in other reports this week

Incidents involving agents and credentials are not limited to this case. In a report released on October 9, Anthropic said models under evaluation got around access restrictions by extracting tokens from browser settings and by paying fees. If an agent has a means of payment, that becomes one more tool for completing its task. OpenAI's agent also used credentials and developer keys it found online to pull data from US government agency websites.

Ways for entrusted credentials to leak keep turning up as well. The official MCP Python SDK had a flaw that let a malicious server redirect where OAuth tokens were sent. A US federal MCP server reportedly logged error responses containing veterans' Social Security numbers (SSNs) without redacting them. The arXiv paper "MemLeak" (2610.04195) showed that when agent memory is shared, 70–100% of other users' information leaks even without an attack. In "HarnessSecurity-Bench" (2610.07639), turning on auto-approval raised attack success rates to as high as 95.6%. An agent that takes card images in a chat and goes ahead with payment without confirmation sits where all of these weaknesses overlap.

What xAI needs to answer

When judging an agent trusted with payments, the real question is not whether it picks products well. Where are card images stored, and for how long? Is there a way to keep the full card number hidden from the model and from other companies? Does a human confirm before payment? Are there limits? Who is responsible if an unauthorized payment happens? For now, the reports answer none of these questions.

The address and last four digits on the demo screen may not cause harm right away. Still, the fact that display controls were missing even at the marketing stage shows that how the data is handled once entrusted needs outside scrutiny. In an era of handing agents our wallets, Evals must measure more than task completion rates. They must also measure whether agents keep credentials hidden, avoid retaining them, and never use them without permission.