Musk encourages users to give credit card info to Grok Bot while SpaceXAI silently updates its privacy policy

Elon Musk is encouraging users to commit a cybersecurity sin after SpaceXAI quietly updated its privacy policy, which now states that users can share personal data with Grok.

In an effort to promote his always-on agent, Musk is encouraging his followers to commit a cardinal sin of cybersecurity: sharing images of their credit cards with Grok Bot.

Musk claims that Grok Bot can easily scour the internet for the best deals, add them to the basket, and check out all on its own.

“I just asked Grok @Bot to research the most fun Lego Star Wars kits for young kids and order them. As easy as that,” said Musk.

But, to do this, Grok Bot needs your credit card details. Something that SpaceXAI told users they should never do, that’s until relatively recently.

SpaceXAI quietly updated its privacy policy

SpaceXAI quietly updated its privacy policy, removing the parts that warned users not to share personal information in prompts and inputs, since the company can’t control what users give to Grok.

“We cannot control what you provide us. You are responsible for all actions, including providing payment information and other actions, as if you had taken them yourself,” the updated privacy policy states.

This updated policy is entirely different from what Musk said before: “If Grok Bot messes up, we will make you whole.”

However, SpaceXAI still discourages users from inputting “sensitive personal information,” including data relating to race, ethnicity, political orientation, and health or biometrics.

While credit card information isn’t explicitly listed, financial data is still considered high-risk due to the risk of identity theft and fraud.

Why you shouldn’t share financial data with chatbots

While Musk and pro-Musk tech commentator Min Choi encourage their followers to give Grok Bot a photo of their credit card so it can shop for them, there are several reasons this isn’t a good idea.

SpaceXAI’s privacy policy also states that providing personal information, such as files, images, audio, voice, video, and other inputs, may be used by Grok when generating responses.

“If you include personal information in inputs you provide…this information may be reproduced in the output,” SpaceXAI said.

Therefore, those who have allegedly provided Grok with their credit card numbers could risk exposing themselves to other users.

Since Grok Bot is shared, “there is a risk of it mixing up context, and accidentally revealing your info to other users, or using your credit card for other people's purchases,” said Cybernews senior researcher Aras Nazarovas.

This is what one tech CEO discovered when Grok Bot leaked personal financial information to his employees on Slack.

While the risk of data leaks leading to identity theft and fraud persists, Cybernews information security researcher Rasa Jurgutytė explained that Musk and Choi’s encouragement could have negative consequences.

“This level of trust for Grok that is encouraged by Musk only makes it more of a target for prompt injection and other attacks, since there’s a possibility that it could handle financial transactions that could be manipulated.”

All the hype surrounding Grok Bot's ability to handle financial information and transactions autonomously may make it an appealing target for hackers seeking to steal information or manipulate transactions for their benefit.

But, even without the assistance of bad actors, AI agents are known to hallucinate and “are not immune to making mistakes, leading to financial losses for people,” said Jurgutytė.