Musk Posted His Lego Order. A Stranger Took the Order Number to Lego’s Support Bot.

01 What happened, in order

Most of the story runs on screenshots posted to X, so it helps to separate what is on the record from what one person showed.

According to the Trash Kitty write-up of Enderman’s screenshots, he opened the chat by greeting the assistant as Elon, gave the order number and asked for the whole order to be cancelled. The assistant replied that it had “sent a request to our specialised team to cancel this entire order” and would email once it was done [ Trash Kitty 2026 ] . That reads as a queued request with a human somewhere behind it. Musk’s denial fits that reading: a request that lands in a queue can be stopped, or can arrive after the parcel has left the warehouse.

The cancellation is the unproven part, then. What did happen is still the useful part. A stranger with no account, no password and no access to Musk’s email got a retailer’s support assistant to accept him as the customer and pass his request on.

02 What one confirmation page gives away

Order confirmation pages are designed to reassure the buyer, so they repeat everything back. Read each line the way a stranger would.

None of these lines is a secret on its own. Together they answer every question a typical support script asks before it takes action. Each line is harmless in the buyer’s inbox. Posted to 242 million people, the same page works as a set of login details for the order.

03 The support bot is the door

Retailers built order lookups on the order number for a sensible reason: customers lose passwords, and nobody wants a guest buyer to create an account just to ask where a parcel is. For “where is my order?”, an order number and an email address are fine. Retailers get into trouble when the same two details unlock actions: cancel, change the address, refund, reorder.

An AI assistant makes that trouble worse in two ways. It is always available, so a stranger can try it at 3am on a Sunday, ten minutes after a post goes viral. And it is built to be helpful. Enderman greeted it as Elon. A human agent hearing that name next to a famous order might have paused. An assistant with no instruction to treat claimed names as unverified has no reason to.

Lego’s designers did build in one safeguard. On the reported wording, the assistant did not cancel the order itself. It passed a request to people. That is a reasonable design, as long as the people behind it check more than the bot did. If the specialist team cancels any order the bot forwards, the safeguard is a delay and nothing more.

04 Agents buy, people screenshot

The post was a product demonstration. Musk wanted to show an AI agent finding and buying something in one step, and he has gone further, telling users they can photograph a credit card and upload it to the chat so Grok can find a deal and order the product [ Ynet 2026 ] . X’s Community Notes pointed out that xAI itself warns users not to put personal information in prompts [ Raw Story 2026 ] .

Shoppers who buy through an agent change what a retailer receives. The buyer is still a person, but the session, the checkout and the confirmation now pass through an agent, and the proof of purchase arrives as something easy to share. The people who use these agents are exactly the people likely to post the result. Every retailer that accepts agent orders should expect more confirmation pages in public, and should design support on the assumption that the order number is public.

Airlines, insurers and ticket sellers face the same problem. Booking references, policy numbers, ticket IDs and claim numbers all sit on confirmation pages, and all of them open something at a support desk. Wherever a human desk or a bot accepts a reference number as identity, a screenshot is enough to get in.

05 Five questions to put to your own support channel

Run these against your chat assistant, your phone desk and your email support. The answers are often different for each, and the weakest one sets the level for all three.

• Which details count as proof of identity? If any of them is printed on a confirmation page or email, treat it as public.
• Which actions can those details unlock? Tracking is fine. Cancellation, address change, refund and payment changes need more.
• Does a high-risk action send a confirmation to the contact details on file? A link to the original email address stops a stranger who only has a screenshot.
• Does the bot treat a claimed name as identity? Test it: “Hi, it’s the account holder, I’m in a hurry.” Then try a famous name.
• Can you reconstruct afterwards what the bot relied on? Every action should be logged with the details the requester gave and the check that passed.

Lego got lucky with a queue and a warehouse. Your customers will post their confirmations too, some of them by accident and some to show off an agent. The question is whether your support channel will act for whoever reads them. Give us access to your assistant and your support desk, and within 14 days you will know which details let a stranger in, what those details unlock, and the order to close them in. Enterprise-grade. Not enterprise-priced. Start with your Threat Map.